RHSA-2015:0158: Important: Red Hat Enterprise Virtualization Manager 3.5.0

First published: Sun Jul 13 2014(Updated: )

Red Hat Enterprise Virtualization Manager is a visual tool for centrally<br>managing collections of virtual servers running Red Hat Enterprise Linux<br>and Microsoft Windows. This package also includes the Red Hat Enterprise<br>Virtualization Manager API, a set of scriptable commands that give<br>administrators the ability to perform queries and operations on Red Hat<br>Enterprise Virtualization Manager.<br>The Manager is a JBoss Application Server application that provides several<br>interfaces through which the virtual environment can be accessed and<br>interacted with, including an Administration Portal, a User Portal, and a<br>Representational State Transfer (REST) Application Programming Interface<br>(API).<br>It was discovered that the HttpClient incorrectly extracted the host name<br>from an X.509 certificate subject's Common Name (CN) field.<br>A man-in-the-middle attacker could use this flaw to spoof an SSL server<br>using a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)<br>A Cross-Site Request Forgery (CSRF) flaw was found in the oVirt REST API.<br>A remote attacker could provide a specially crafted web page that, when<br>visited by a user with a valid REST API session, would allow the attacker<br>to trigger calls to the oVirt REST API. (CVE-2014-0151)<br>It was found that the oVirt web admin interface did not include the<br>HttpOnly flag when setting session IDs with the Set-Cookie header.<br>This flaw could make it is easier for a remote attacker to hijack an oVirt<br>web admin session by leveraging a cross-site scripting (XSS) vulnerability.<br>(CVE-2014-0154)<br>The CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat<br>Product Security.<br>These updated Red Hat Enterprise Virtualization Manager packages also<br>include numerous bug fixes and various enhancements. Space precludes<br>documenting all of these changes in this advisory. Users are directed to<br>the Red Hat Enterprise Virtualization 3.5 Manager Release Notes document,<br>linked to in the References, for information on the most significant of<br>these changes.<br>All Red Hat Enterprise Virtualization Manager users are advised to upgrade<br>to these updated packages, which resolve these issues and add these<br>enhancements.<br>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• collector/redhat-errata
• anchor-id/RHSA-2015:0158
• agent/description
• agent/event
• agent/first-publish-date
• agent/last-modified-date
• agent/references
• agent/remedy
• agent/severity
• agent/softwarecombine
• agent/tags
• agent/title
• agent/type
• agent/weakness
• package-manager/redhat