Exploit/Advisories no image

Published on November 17th, 2021 📆 | 7083 Views ⚑

0

Red Hat Security Advisory 2021-4703-01 – Torchsec

—–BEGIN PGP SIGNED MESSAGE—–
Hash: SHA256

=====================================================================
Red Hat Security Advisory

Synopsis: Important: RHV Engine and Host Common Packages security update [ovirt-4.4.9]
Advisory ID: RHSA-2021:4703-01
Product: Red Hat Virtualization
Advisory URL: https://access.redhat.com/errata/RHSA-2021:4703
Issue date: 2021-11-16
CVE Names: CVE-2021-3620
=====================================================================

1. Summary:

Updated dependency packages for ovirt-engine and ovirt-host that fix
several bugs and add various enhancements are now available.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

RHEL-8-RHEV-S-4.4 – Red Hat Virtualization Engine 4.4 – noarch, x86_64
Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts – noarch, ppc64le, x86_64
Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8 – noarch

3. Description:

The ovirt-engine package provides the Red Hat Virtualization Manager, a
centralized management platform that allows system administrators to view
and manage virtual machines. The Manager provides a comprehensive range of
features including search capabilities, resource management, live
migrations, and virtual infrastructure provisioning.

The ovirt.ovirt package (previously ovirt-ansible-collection) manages all
oVirt Ansible modules.

The ovirt-ansible-hosted-engine-setup package provides an Ansible role for
deploying Red Hat Virtualization Hosted-Engine.

otopi is a standalone, plug-in based installation framework to be used to
set up system components. The plug-in nature provides simplicity to add new
installation functionality without the complexity of the state and
transaction management.

Security Fix(es):

* Ansible: ansible-connection module discloses sensitive info in traceback
error message (CVE-2021-3620)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Bug Fix(es):

* A playbook executed by Ansible Engine 2.9.25 inside a virtual machine
running on Red Hat Virtualization 4.4.9 correctly detects that this is a
virtual machine running on Red Hat Virtualization by using Ansible facts.
(BZ#1904085)

* Red Hat Virtualization now supports Ansible-2.9.27 for internal usage.
(BZ#2003671)

* Previously, upgrading from Red Hat Virtualization 4.3 failed when using
an isolated network during IPv6 deployment. In this release, a forward
network is used instead of an isolated network during an IPv6 deployment.
As a result, upgrade from Red Hat Virtualization 4.3 using IPv6 now
succeeds. (BZ#1947709)

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/2974891

5. Bugs fixed (https://bugzilla.redhat.com/):

1947709 – [IPv6] HostedEngineLocal is an isolated libvirt network, breaking upgrades from 4.3
1975767 – CVE-2021-3620 Ansible: ansible-connection module discloses sensitive info in traceback error message
2003671 – Bump Ansible distributed within RHV channels to 2.9.27
2010670 – Upgrade otopi to 1.9.6

6. Package List:

Red Hat Virtualization 4 Tools for Red Hat Enterprise Linux 8:

Source:
ovirt-ansible-collection-1.6.5-1.el8ev.src.rpm

noarch:
ovirt-ansible-collection-1.6.5-1.el8ev.noarch.rpm

Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts:

Source:
ansible-2.9.27-1.el8ae.src.rpm
otopi-1.9.6-2.el8ev.src.rpm
ovirt-ansible-collection-1.6.5-1.el8ev.src.rpm
ovirt-imageio-2.3.0-1.el8ev.src.rpm

noarch:
ansible-2.9.27-1.el8ae.noarch.rpm
otopi-common-1.9.6-2.el8ev.noarch.rpm
otopi-debug-plugins-1.9.6-2.el8ev.noarch.rpm
ovirt-ansible-collection-1.6.5-1.el8ev.noarch.rpm
python3-otopi-1.9.6-2.el8ev.noarch.rpm

ppc64le:
ovirt-imageio-client-2.3.0-1.el8ev.ppc64le.rpm
ovirt-imageio-common-2.3.0-1.el8ev.ppc64le.rpm
ovirt-imageio-common-debuginfo-2.3.0-1.el8ev.ppc64le.rpm
ovirt-imageio-daemon-2.3.0-1.el8ev.ppc64le.rpm
ovirt-imageio-debugsource-2.3.0-1.el8ev.ppc64le.rpm

x86_64:
ovirt-imageio-client-2.3.0-1.el8ev.x86_64.rpm
ovirt-imageio-common-2.3.0-1.el8ev.x86_64.rpm
ovirt-imageio-common-debuginfo-2.3.0-1.el8ev.x86_64.rpm
ovirt-imageio-daemon-2.3.0-1.el8ev.x86_64.rpm
ovirt-imageio-debugsource-2.3.0-1.el8ev.x86_64.rpm

RHEL-8-RHEV-S-4.4 – Red Hat Virtualization Engine 4.4:

Source:
ansible-2.9.27-1.el8ae.src.rpm
otopi-1.9.6-2.el8ev.src.rpm
ovirt-ansible-collection-1.6.5-1.el8ev.src.rpm
ovirt-imageio-2.3.0-1.el8ev.src.rpm

noarch:
ansible-2.9.27-1.el8ae.noarch.rpm
otopi-common-1.9.6-2.el8ev.noarch.rpm
otopi-debug-plugins-1.9.6-2.el8ev.noarch.rpm
ovirt-ansible-collection-1.6.5-1.el8ev.noarch.rpm
python3-otopi-1.9.6-2.el8ev.noarch.rpm

x86_64:
ovirt-imageio-client-2.3.0-1.el8ev.x86_64.rpm
ovirt-imageio-common-2.3.0-1.el8ev.x86_64.rpm
ovirt-imageio-common-debuginfo-2.3.0-1.el8ev.x86_64.rpm
ovirt-imageio-daemon-2.3.0-1.el8ev.x86_64.rpm
ovirt-imageio-debugsource-2.3.0-1.el8ev.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-3620
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
—–BEGIN PGP SIGNATURE—–
Version: GnuPG v1

iQIVAwUBYZQXltzjgjWX9erEAQjvjw/6Ag0jbBYE+89ki14FkfjvY60Wy/wI2M5s
gp5CiTEaW15tASirPRXVBv+i9Cwug9ara0IaaHEHRAoMmw61PlWdH39SjDVFyVHM
poeSIR1YslISuabjsUGG8uVUsfiaKP4Xsg1QgtfOKn/g1DZVPgoyHby9VnIFcgRX
/6mZQTOo+SW6/kuwUlx04/kjCxasX38iMJZlXVg82HwpPKPN7evukrlaE5haS+ja
gronKHu9PW96N23u/VlssC4em8uoQ1gw0YSJzr38Ei2QOYbatdaYE3b6/yVX+UuN
LEDNdwSbPTt458snmf+CtAqef7X6NWuWz+dsVEtiH1tqcBI/maqfvElRxKQZ3bIF
qlnhWGJUDLpZODyBkS9zuZxe8mmxM89a2WuggD6PvCOO1zFJmvXc1Ad/Quh2Hhii
Wp1bTDeSUl1bfIooPEoGVTPrNIsjgYpt3y4iqvoxzMF77wLmPs976TRLKF1a1vDo
IMLJZtPx57WWopXubMyBvGwK3GyzQr4aSHGT2/HJTN/hwbEOBaIfcFXl4/fX3yX4
P++OEZN+cDmDIdRbKn1AXiv8IkvtTSS2dUJ3+elPkN05T+IR+u5K2VjbMPOuW4IJ
DKYXHGtp2y785sDmxH2M5ug8QYzPBEFW7CC4QlWl9jSu/vWm3xBiHhUx/uaeS3qP
clPd21+yCtc=
=wKss
—–END PGP SIGNATURE—–


RHSA-announce mailing list
[email protected]
https://listman.redhat.com/mailman/listinfo/rhsa-announce

Source link

Tagged with:



Leave a Reply

Your email address will not be published. Required fields are marked *