RHSA-2021:2865: Moderate: RHV Manager (ovirt-engine) security update [ovirt-4.4.7]

Published Jul 22, 2021
·
Updated

The ovirt-engine package provides the manager for virtualization environments.This manager enables admins to define hosts and networks, as well as to addstorage, create VMs and manage user permissions.Security Fix(es): nodejs-underscore: Arbitrary code execution via the template function (CVE-2021-23358) nodejs-glob-parent: Regular expression denial of service (CVE-2020-28469) nodejs-ua-parser-js: Regular expression denial of service via the regex (CVE-2020-7733) nodejs-path-parse: ReDoS via splitDeviceRe, splitTailRe and splitPathRe (CVE-2021-23343) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.Bug Fix(es): Foreman integration, which allows you to provision bare metal hosts from the Administration Portal using Foreman and then added to the Manager, was deprecated in oVirt 4.4.6 / RHV 4.4.6 and removed completely in oVirt 4.4.7 / RHV 4.4.7. Similar functionality to provision bare metal hosts can be achieved using Foreman directly and adding an already provisioned host using the Administration Portal or the REST API. (BZ#1901011) Adding a message banner to the web administration welcome page is straight forward using custom branding that only contains a preamble section. An example of preamble branding is given here: https://bugzilla.redhat.com/attachment.cgi?id=1783329.In an engine upgrade, the custom preamble brand remains in place and will work without issue.During engine backup and subsequent restore, on engine restore the custom preamble branding needs to be manually restored/reinstalled and verified. (BZ#1804774) The column name threadspercore in the Red hat Virtualization manager Dashboard is being deprecated, and will be removed in a future release. In version 4.4.7.2 the column name for threadspercore will be changed to numberofthreads.In the Data Warehouse, the old name will be retained as an additional alias, resulting in 2 columns providing the same data: numberofthreads and threadspercore, and threadspercore will be removed in a future version. (BZ#1896359)

Affected Software

29 affected componentsFixes available
redhat/ovirt-engine<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-dwh<4.4.7.3-1.el8e
4.4.7.3-1.el8e
redhat/ovirt-engine-extension-aaa-ldap<1.4.4-1.el8e
1.4.4-1.el8e
redhat/ovirt-engine-ui-extensions<1.2.7-1.el8e
1.2.7-1.el8e
redhat/ovirt-web-ui<1.7.0-1.el8e
1.7.0-1.el8e
redhat/rhv-log-collector-analyzer<1.0.10-1.el8e
1.0.10-1.el8e
redhat/rhvm-branding-rhv<4.4.9-1.el8e
4.4.9-1.el8e
redhat/ovirt-engine-backend<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-dbscripts<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-dwh-grafana-integration-setup<4.4.7.3-1.el8e
4.4.7.3-1.el8e
redhat/ovirt-engine-dwh-setup<4.4.7.3-1.el8e
4.4.7.3-1.el8e
redhat/ovirt-engine-extension-aaa-ldap-setup<1.4.4-1.el8e
1.4.4-1.el8e
redhat/ovirt-engine-health-check-bundler<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-restapi<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-setup<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-setup-base<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-setup-plugin-cinderlib<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-setup-plugin-imageio<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-setup-plugin-ovirt-engine<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-setup-plugin-ovirt-engine-common<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-setup-plugin-vmconsole-proxy-helper<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-setup-plugin-websocket-proxy<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-tools<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-tools-backup<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-vmconsole-proxy-helper<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-webadmin-portal<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/ovirt-engine-websocket-proxy<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/python3-ovirt-engine-lib<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e
redhat/rhvm<4.4.7.6-0.11.el8e
4.4.7.6-0.11.el8e

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/ovirt-engine to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  2. Upgrade

    Upgrade redhat/ovirt-engine-dwh to a version that resolves this vulnerability.

    Fixed in 4.4.7.3-1.el8e
  3. Upgrade

    Upgrade redhat/ovirt-engine-extension-aaa-ldap to a version that resolves this vulnerability.

    Fixed in 1.4.4-1.el8e
  4. Upgrade

    Upgrade redhat/ovirt-engine-ui-extensions to a version that resolves this vulnerability.

    Fixed in 1.2.7-1.el8e
  5. Upgrade

    Upgrade redhat/ovirt-web-ui to a version that resolves this vulnerability.

    Fixed in 1.7.0-1.el8e
  6. Upgrade

    Upgrade redhat/rhv-log-collector-analyzer to a version that resolves this vulnerability.

    Fixed in 1.0.10-1.el8e
  7. Upgrade

    Upgrade redhat/rhvm-branding-rhv to a version that resolves this vulnerability.

    Fixed in 4.4.9-1.el8e
  8. Upgrade

    Upgrade redhat/ovirt-engine-backend to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  9. Upgrade

    Upgrade redhat/ovirt-engine-dbscripts to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  10. Upgrade

    Upgrade redhat/ovirt-engine-dwh-grafana-integration-setup to a version that resolves this vulnerability.

    Fixed in 4.4.7.3-1.el8e
  11. Upgrade

    Upgrade redhat/ovirt-engine-dwh-setup to a version that resolves this vulnerability.

    Fixed in 4.4.7.3-1.el8e
  12. Upgrade

    Upgrade redhat/ovirt-engine-extension-aaa-ldap-setup to a version that resolves this vulnerability.

    Fixed in 1.4.4-1.el8e
  13. Upgrade

    Upgrade redhat/ovirt-engine-health-check-bundler to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  14. Upgrade

    Upgrade redhat/ovirt-engine-restapi to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  15. Upgrade

    Upgrade redhat/ovirt-engine-setup to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  16. Upgrade

    Upgrade redhat/ovirt-engine-setup-base to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  17. Upgrade

    Upgrade redhat/ovirt-engine-setup-plugin-cinderlib to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  18. Upgrade

    Upgrade redhat/ovirt-engine-setup-plugin-imageio to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  19. Upgrade

    Upgrade redhat/ovirt-engine-setup-plugin-ovirt-engine to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  20. Upgrade

    Upgrade redhat/ovirt-engine-setup-plugin-ovirt-engine-common to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  21. Upgrade

    Upgrade redhat/ovirt-engine-setup-plugin-vmconsole-proxy-helper to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  22. Upgrade

    Upgrade redhat/ovirt-engine-setup-plugin-websocket-proxy to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  23. Upgrade

    Upgrade redhat/ovirt-engine-tools to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  24. Upgrade

    Upgrade redhat/ovirt-engine-tools-backup to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  25. Upgrade

    Upgrade redhat/ovirt-engine-vmconsole-proxy-helper to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  26. Upgrade

    Upgrade redhat/ovirt-engine-webadmin-portal to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  27. Upgrade

    Upgrade redhat/ovirt-engine-websocket-proxy to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  28. Upgrade

    Upgrade redhat/python3-ovirt-engine-lib to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  29. Upgrade

    Upgrade redhat/rhvm to a version that resolves this vulnerability.

    Fixed in 4.4.7.6-0.11.el8e
  30. Configuration

    Use the renamed column number_of_threads in version 4.4.7.2; in the Data Warehouse, threads_per_core remains as an additional alias until a future release.

    RHV Manager Dashboard threads_per_core = number_of_threads
  31. Configuration

    Add the message banner using custom branding that contains a preamble section.

    RHV Manager web administration welcome page custom branding preamble = enabled
  32. Compensating control

    Because Foreman integration was removed in RHV 4.4.7, provision bare metal hosts directly with Foreman and add the already provisioned hosts through the Administration Portal or REST API.

  33. Operational

    After restoring the engine from a backup, manually restore or reinstall the custom preamble branding and verify it.

Event History

Jul 22, 2021
Advisory Published
via Red Hat·12:00 AM
Data Sourced
via Red Hat·12:00 AM
RemedyDescriptionAffected Software

Frequently Asked Questions

1

What is the severity of RHSA-2021:2865?

The severity of RHSA-2021:2865 is critical.

2

How do I fix RHSA-2021:2865?

To fix RHSA-2021:2865, update the ovirt-engine package to version 4.4.7.6-0.11.el8e or higher.

3

Which packages are affected by RHSA-2021:2865?

The affected packages include ovirt-engine, ovirt-engine-dwh, and various ovirt-engine extensions among others.

4

What type of vulnerability is addressed in RHSA-2021:2865?

RHSA-2021:2865 addresses an arbitrary code execution vulnerability in the nodejs-underscore package.

5

Is there a specific Red Hat version required for the fix in RHSA-2021:2865?

Yes, the fix for RHSA-2021:2865 requires Red Hat Enterprise Linux 8.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203