RHSA-2012:0421: Moderate: rhevm security and bug fix update

First published: Mon Mar 26 2012(Updated: )

Red Hat Enterprise Virtualization Manager is a visual tool for centrally<br>managing collections of virtual machines running Red Hat Enterprise Linux<br>and Microsoft Windows. These packages also include the Red Hat Enterprise<br>Virtualization Manager REST (Representational State Transfer) API, a set of<br>scriptable commands that give administrators the ability to perform queries<br>and operations on Red Hat Enterprise Virtualization Manager.<br>It was found that RESTEasy was vulnerable to XML External Entity (XXE)<br>attacks. If a remote attacker who is able to access the Red Hat Enterprise<br>Virtualization Manager REST API submitted a request containing an external<br>XML entity to a RESTEasy endpoint, the entity would be resolved, allowing<br>the attacker to read files accessible to the user running the application<br>server. This flaw affected DOM (Document Object Model) Document and JAXB<br>(Java Architecture for XML Binding) input. (CVE-2012-0818)<br>This update also fixes the following bugs:<br><li> Previously the REST API was ignoring the "Accept" header. This made it</li> impossible to retrieve detailed information about specific sub-collections,<br>including hosts and disks. The REST API has been updated and now processes<br>the "Accept" header as originally intended. (BZ#771369)<br><li> The "start_time" Virtual Machine property was previously always set. This</li> meant that even Virtual Machines that were stopped, had a value for<br>"start_time". An update has been made to ensure that the "start_time"<br>property is only set when the Virtual Machine has been started, and is<br>running. (BZ#772975)<br><li> The 'rhevm-setup' script previously only ran successfully on systems with</li> their locale set to 'en_US.UTF-8', 'en_US.utf-8', or 'en_US.utf8'. The<br>script has since been updated to also run successfully in additional<br>locales, including 'ja_JP.UTF-8'. (BZ#784860)<br><li> The REST API did not previously validate that all required parameters</li> were provided when enabling power management. The response code returned<br>would also incorrectly indicate the operation had succeeded where<br>mandatory parameters were not supplied. An update has been made to ensure<br>that the power management parameters are validated correctly. (BZ#785744)<br><li> Previously no warning or error was issued when the amount of free disk</li> space on a host was low. When no free disk space remained on the host it<br>would become non-responsive with no prior warning. An update has been made<br>to report a warning in the audit log when a host's free disk space is less<br>than 1000 MB, and an error when a host's free disk space is less than 500<br>MB. (BZ#786132)<br><li> When importing Virtual Machines no notification was provided if the MAC</li> address of the network interface card clashed with that of an existing<br>Virtual Machine. Now when this occurs a message is printed to the audit<br>log, highlighting the need for manual intervention. (BZ#795416)<br><li> Previously it was not possible to set more, or less, than one value for</li> SpiceSecureChannels using the rhevm-config tool. This meant it was not<br>possible to encrypt all SPICE channels. The rhevm-config tool has been<br>updated and it is now possible to encrypt all SPICE channels, by adding<br>them to the SpiceSecureChannels configuration key. (BZ#784012)<br>All Red Hat Enterprise Virtualization users are advised to upgrade to these<br>updated packages, which address this vulnerability and fix these bugs.<br>Refer to the Solution section for information about installing this update.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2012:0421
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• package-manager/redhat