RHSA-2023:0074: Important: RHV 4.4 SP1 [ovirt-4.5.3-3] security update
The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities, resource management, live migrations, and virtual infrastructure provisioning.<br>Security fix(es):<br><li> mina-sshd: Java unsafe deserialization vulnerability (CVE-2022-45047)</li> <li> isomorphic-git: Directory traversal via a crafted repository (CVE-2021-30483)</li> For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.<br>Bug Fix(es):<br><li> With this release, SELinux rules for the Grafana HTTP port are now properly set up for new remote DWH installations as part of the Red Hat Virtualization Manager engine-setup. (BZ#2126778)</li> <li> Previously, search conditions were not applied properly when a non-admin user tried to search for Clusters or Data Centers over the REST API. In this release, both admin and non-admin users can search for clusters properly using the REST API. (BZ#2144346)</li> <li> Previously, stale bitmaps in the base image during a cold or live internal merge caused the operation to fail. In this release, the merge operation succeeds. (BZ#2141371)</li>
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2023:0074?
The severity of RHSA-2023:0074 is critical.
How do I fix RHSA-2023:0074?
To fix RHSA-2023:0074, update the affected package to the remedial versions provided in the advisory.
Which packages are affected by RHSA-2023:0074?
The packages affected by RHSA-2023:0074 include ovirt-engine, apache-sshd, and various ovirt-engine-ui components.
What does RHSA-2023:0074 address?
RHSA-2023:0074 addresses vulnerabilities in the ovirt-engine package, impacting the Red Hat Virtualization Manager.
Is a system reboot required after applying the fix for RHSA-2023:0074?
Yes, a system reboot may be required after applying the fix for RHSA-2023:0074.