- Vulnerability/
- RHSA-2022:5555
RHSA-2022:5555: Moderate: RHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update
First published: Thu Jul 14 2022(Updated: )
The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities, resource management, live migrations, and virtual infrastructure provisioning.<br>Security Fix(es):<br><li> nodejs-trim-newlines: ReDoS in .end() method (CVE-2021-33623)</li> <li> apache-commons-compress: infinite loop when reading a specially crafted 7Z archive (CVE-2021-35515)</li> <li> apache-commons-compress: excessive memory allocation when reading a specially crafted 7Z archive (CVE-2021-35516)</li> <li> apache-commons-compress: excessive memory allocation when reading a specially crafted TAR archive (CVE-2021-35517)</li> <li> apache-commons-compress: excessive memory allocation when reading a specially crafted ZIP archive (CVE-2021-36090)</li> <li> nodejs-ansi-regex: Regular expression denial of service (ReDoS) matching ANSI escape codes (CVE-2021-3807)</li> <li> spring-expression: Denial of service via specially crafted SpEL expression (CVE-2022-22950)</li> <li> semantic-release: Masked secrets can be disclosed if they contain characters that are excluded from uri encoding (CVE-2022-31051)</li> For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.<br>A list of bugs fixed in this update is available in the Technical Notes book:<br><a href="https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes" target="_blank">https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes</a>
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/apache-commons-compress | <1.21-1.2.el8e | 1.21-1.2.el8e |
| redhat/ovirt-dependencies | <4.5.2-1.el8e | 4.5.2-1.el8e |
| redhat/ovirt-engine | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-dwh | <4.5.3-1.el8e | 4.5.3-1.el8e |
| redhat/ovirt-engine-ui-extensions | <1.3.4-1.el8e | 1.3.4-1.el8e |
| redhat/ovirt-log-collector | <4.4.6-1.el8e | 4.4.6-1.el8e |
| redhat/ovirt-web-ui | <1.9.0-1.el8e | 1.9.0-1.el8e |
| redhat/postgresql-jdbc | <42.2.14-1.el8e | 42.2.14-1.el8e |
| redhat/rhv-log-collector-analyzer | <1.0.14-1.el8e | 1.0.14-1.el8e |
| redhat/rhvm-branding-rhv | <4.5.0-1.el8e | 4.5.0-1.el8e |
| redhat/apache-commons-compress-javadoc | <1.21-1.2.el8e | 1.21-1.2.el8e |
| redhat/ovirt-engine-backend | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-dbscripts | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-dwh-grafana-integration-setup | <4.5.3-1.el8e | 4.5.3-1.el8e |
| redhat/ovirt-engine-dwh-setup | <4.5.3-1.el8e | 4.5.3-1.el8e |
| redhat/ovirt-engine-health-check-bundler | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-restapi | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-setup | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-setup-base | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-setup-plugin-cinderlib | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-setup-plugin-imageio | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-setup-plugin-ovirt-engine | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-setup-plugin-ovirt-engine-common | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-setup-plugin-vmconsole-proxy-helper | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-setup-plugin-websocket-proxy | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-tools | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-tools-backup | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-vmconsole-proxy-helper | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-webadmin-portal | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/ovirt-engine-websocket-proxy | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/postgresql-jdbc-javadoc | <42.2.14-1.el8e | 42.2.14-1.el8e |
| redhat/python3-ovirt-engine-lib | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
| redhat/rhvm | <4.5.1.2-0.11.el8e | 4.5.1.2-0.11.el8e |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://bugzilla.redhat.com/show_bug.cgi?id=1663217
- https://bugzilla.redhat.com/show_bug.cgi?id=1782077
- https://bugzilla.redhat.com/show_bug.cgi?id=1849045
- https://bugzilla.redhat.com/show_bug.cgi?id=1852308
- https://bugzilla.redhat.com/show_bug.cgi?id=1958032
- https://bugzilla.redhat.com/show_bug.cgi?id=1966615
- https://bugzilla.redhat.com/show_bug.cgi?id=1976607
- https://bugzilla.redhat.com/show_bug.cgi?id=1981895
- https://bugzilla.redhat.com/show_bug.cgi?id=1981900
- https://bugzilla.redhat.com/show_bug.cgi?id=1981903
- https://bugzilla.redhat.com/show_bug.cgi?id=1981909
- https://bugzilla.redhat.com/show_bug.cgi?id=1994144
- https://bugzilla.redhat.com/show_bug.cgi?id=2001574
- https://bugzilla.redhat.com/show_bug.cgi?id=2001923
- https://bugzilla.redhat.com/show_bug.cgi?id=2006625
- https://bugzilla.redhat.com/show_bug.cgi?id=2007557
- https://bugzilla.redhat.com/show_bug.cgi?id=2030293
- https://bugzilla.redhat.com/show_bug.cgi?id=2068270
- https://bugzilla.redhat.com/show_bug.cgi?id=2069414
- https://bugzilla.redhat.com/show_bug.cgi?id=2070045
- https://bugzilla.redhat.com/show_bug.cgi?id=2072626
- https://bugzilla.redhat.com/show_bug.cgi?id=2081241
- https://bugzilla.redhat.com/show_bug.cgi?id=2081559
- https://bugzilla.redhat.com/show_bug.cgi?id=2089856
- https://bugzilla.redhat.com/show_bug.cgi?id=2092885
- https://bugzilla.redhat.com/show_bug.cgi?id=2093795
- https://bugzilla.redhat.com/show_bug.cgi?id=2097414
- https://bugzilla.redhat.com/show_bug.cgi?id=2099650
- https://bugzilla.redhat.com/show_bug.cgi?id=2105296
- https://access.redhat.com/security/updates/classification/#moderate
- https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes
- https://access.redhat.com/errata/RHSA-2022:5555 (Advisory)
- agent/description
- agent/event
- agent/first-publish-date
- agent/last-modified-date
- agent/references
- agent/remedy
- agent/severity
- agent/softwarecombine
- agent/tags
- agent/title
- agent/type
- collector/redhat-errata
- source/Red Hat
- anchor-id/RHSA-2022:5555
- agent/software-canonical-lookup
- package-manager/redhat