RHSA-2020:5179: Low: Red Hat Virtualization security, bug fix, and enhancement update

First published: Tue Nov 24 2020(Updated: )

The org.ovirt.engine-root is a core component of oVirt.<br>The following packages have been upgraded to a later upstream version: engine-db-query (1.6.2), org.ovirt.engine-root (4.4.3.8), ovirt-engine-dwh (4.4.3.1), ovirt-engine-extension-aaa-ldap (1.4.2), ovirt-engine-extension-logger-log4j (1.1.1), ovirt-engine-metrics (1.4.2.1), ovirt-engine-ui-extensions (1.2.4), ovirt-log-collector (4.4.4), ovirt-web-ui (1.6.5), rhv-log-collector-analyzer (1.0.5), rhvm-branding-rhv (4.4.6). (BZ#1866981, BZ#1879377)<br>Security Fix(es):<br><li> nodejs-handlebars: lookup helper fails to properly validate templates allowing for arbitrary JavaScript execution (CVE-2019-20920)</li> <li> nodejs-handlebars: an endless loop while processing specially-crafted templates leads to DoS (CVE-2019-20922)</li> <li> nodejs-lodash: prototype pollution in zipObjectDeep function (CVE-2020-8203)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> send --nowait to libvirt when we collect qemu stats, to consume bz#1552092 (BZ#1613514)</li> <li> Block moving HE hosts into different Data Centers and make HE host moved to different cluster NonOperational after activation (BZ#1702016)</li> <li> If an in-use MAC is held by a VM on a different cluster, the engine does not attempt to get the next free MAC. (BZ#1760170)</li> <li> Search backend cannot find VMs which name starts with a search keyword (BZ#1797717)</li> <li> [Permissions] DataCenterAdmin role defined on DC level does not allow Cluster creation (BZ#1808320)</li> <li> enable-usb-autoshare is always 0 in console.vv and usb-filter option is listed two times (BZ#1811466)</li> <li> NumaPinningHelper is not huge pages aware, denies migration to suitable host (BZ#1812316)</li> <li> Adding quota to group doesn't propagate to users (BZ#1822372)</li> <li> Engine adding PCI-E elements on XML of i440FX SeaBIOS VM created from Q35 Template (BZ#1829691)</li> <li> Live Migration Bandwidth unit is different from Engine configuration (Mbps) and VDSM (MBps) (BZ#1845397)</li> <li> RHV-M shows successful operation if OVA export/import failed during "qemu-img convert" phase (BZ#1854888)</li> <li> Cannot hotplug disk reports libvirtError: Requested operation is not valid: Domain already contains a disk with that address (BZ#1855305)</li> <li> rhv-log-collector-analyzer --json fails with TypeError (BZ#1859314)</li> <li> RHV 4.4 on AMD EPYC 7742 throws an NUMA related error on VM run (BZ#1866862)</li> <li> Issue with dashboards creation when sending metrics to external Elasticsearch (BZ#1870133)</li> <li> HostedEngine VM is broken after Cluster changed to UEFI (BZ#1871694)</li> <li> [CNV&amp;RHV]Notification about VM creation contain &lt;UNKNOWN&gt; string (BZ#1873136)</li> <li> VM stuck in Migrating status after migration completed due to incorrect status reported by VDSM after restart (BZ#1877632)</li> <li> Use 4.5 as compatibility level for the Default DataCenter and the Default Cluster during installation (BZ#1879280)</li> <li> unable to create/add index pattern in step 5 from kcs articles#4921101 (BZ#1881634)</li> <li> [CNV&amp;RHV] Remove warning about no active storage domain for Kubevirt VMs (BZ#1883844)</li> <li> Deprecate and remove ovirt-engine-api-explorer (BZ#1884146)</li> <li> [CNV&amp;RHV] Disable creating new disks for Kubevirt VM (BZ#1884634)</li> <li> Require ansible-2.9.14 in ovirt-engine (BZ#1888626)</li> Enhancement(s):<br><li> [RFE] Virtualization support for NVDIMM - RHV (BZ#1361718)</li> <li> [RFE] - enable renaming HostedEngine VM name (BZ#1657294)</li> <li> [RFE] Enabling Icelake new NIs - RHV (BZ#1745024)</li> <li> [RFE] Show vCPUs and allocated memory in virtual machines summary (BZ#1752751)</li> <li> [RFE] RHV-M Deployment/Install Needs it's own UUID (BZ#1825020)</li> <li> [RFE] Destination Host in migrate VM dialog has to be searchable and sortable (BZ#1851865)</li> <li> [RFE] Expose the "reinstallation required" flag of the hosts in the API (BZ#1856671)</li>

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

• agent/severity
• agent/references
• agent/type
• agent/first-publish-date
• agent/softwarecombine
• agent/last-modified-date
• agent/title
• agent/remedy
• agent/description
• agent/tags
• agent/event
• collector/redhat-errata
• source/Red Hat
• anchor-id/RHSA-2020:5179
• agent/software-canonical-lookup
• package-manager/redhat