Operating System:

[RedHat]

Published:

13 August 2019

Protect yourself against future threats.

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

===========================================================================
             AUSCERT External Security Bulletin Redistribution

                               ESB-2019.3075
                  Red Hat Virtualization security update
                              13 August 2019

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:           Red Hat Virtualization
Publisher:         Red Hat
Operating System:  Red Hat Enterprise Linux Server 7
                   Red Hat Enterprise Linux WS/Desktop 7
Impact/Access:     Access Privileged Data -- Remote/Unauthenticated
                   Denial of Service      -- Remote/Unauthenticated
                   Unauthorised Access    -- Existing Account      
Resolution:        Patch/Upgrade
CVE Names:         CVE-2019-10160 CVE-2019-10139 CVE-2019-9636
                   CVE-2019-1559 CVE-2019-0161 CVE-2018-16881
                   CVE-2018-16838  

Reference:         ASB-2019.0200
                   ESB-2019.1579
                   ESB-2019.1325
                   ESB-2019.0913
                   ESB-2019.0620

Original Bulletin: 
   https://access.redhat.com/errata/RHSA-2019:2437

- --------------------------BEGIN INCLUDED TEXT--------------------

- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Virtualization security update
Advisory ID:       RHSA-2019:2437-01
Product:           Red Hat Virtualization
Advisory URL:      https://access.redhat.com/errata/RHSA-2019:2437
Issue date:        2019-08-12
CVE Names:         CVE-2018-16838 CVE-2018-16881 CVE-2019-0161 
                   CVE-2019-1559 CVE-2019-10139 CVE-2019-10160 
=====================================================================

1. Summary:

An update for redhat-virtualization-host is now available for Red Hat
Virtualization 4 for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

RHEL 7-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64
Red Hat Virtualization 4 Hypervisor for RHEL 7 - noarch

3. Description:

The redhat-virtualization-host packages provide the Red Hat Virtualization
Host. These packages include redhat-release-virtualization-host,
ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are
installed using a special build of Red Hat Enterprise Linux with only the
packages required to host virtual machines. RHVH features a Cockpit user
interface for monitoring the host's resources and performing administrative
tasks.

The following packages have been upgraded to a later upstream version:
imgbased (1.1.9), ovirt-node-ng (4.3.5), redhat-release-virtualization-host
(4.3.5), redhat-virtualization-host (4.3.5). (BZ#1669357, BZ#1669365,
BZ#1684986, BZ#1711193, BZ#1717250, BZ#1726917)

Security Fix(es):

* python: regression of CVE-2019-9636 due to functional fix to allow port
numbers in netloc (CVE-2019-10160)

* rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is
enabled (CVE-2018-16881)

* edk2: stack overflow in XHCI causing denial of service (CVE-2019-0161)

* openssl: 0-byte record padding oracle (CVE-2019-1559)

* cockpit-ovirt: admin and appliance passwords saved in plain text variable
file during HE deployment (CVE-2019-10139)

* sssd: improper implementation of GPOs due to too restrictive permissions
(CVE-2018-16838)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/2974891

5. Bugs fixed (https://bugzilla.redhat.com/):

1640820 - CVE-2018-16838 sssd: improper implementation of GPOs due to too restrictive permissions
1658366 - CVE-2018-16881 rsyslog: imptcp: integer overflow when Octet-Counted TCP Framing is enabled
1683804 - CVE-2019-1559 openssl: 0-byte record padding oracle
1687920 - RHVH fails to reinstall if required size is exceeding the available disk space due to anaconda bug
1694065 - CVE-2019-0161 edk2: stack overflow in XHCI causing denial of service
1702223 - Rebase RHV-H on RHEL 7.7
1709829 - CVE-2019-10139 cockpit-ovirt: admin and appliance passwords saved in plain text variable file during HE deployment
1718388 - CVE-2019-10160 python: regression of CVE-2019-9636 due to functional fix to allow port numbers in netloc
1720156 - RHVH 4.3.4 version info is incorrect in plymouth and "/etc/os-release"
1720160 - RHVH 4.3.4: Incorrect info in /etc/system-release-cpe
1720310 - RHV-H post-installation scripts failing, due to existing tags
1720434 - RHVH 7.7 brand is wrong in Anaconda GUI.
1720435 - Failed to install RHVH 7.7
1720436 - RHVH 7.7 should based on RHEL 7.7 server but not workstation.
1724044 - Failed dependencies occur during install systemtap package.
1726534 - dhclient fails to load libdns-export.so.1102 after upgrade if the user installed library is not persisted on the new layer
1727007 - Update RHVH 7.7 branding with new Red Hat logo
1727859 - Failed to boot after upgrading a host with a custom kernel
1728998 - "nodectl info" displays error after RHVH installation
1729023 - The error message is inappropriate when run `imgbase layout --init` on current layout

6. Package List:

Red Hat Virtualization 4 Hypervisor for RHEL 7:

Source:
redhat-virtualization-host-4.3.5-20190722.0.el7_7.src.rpm

noarch:
redhat-virtualization-host-image-update-4.3.5-20190722.0.el7_7.noarch.rpm

RHEL 7-based RHEV-H for RHEV 4 (build requirements):

Source:
imgbased-1.1.9-0.1.el7ev.src.rpm
ovirt-node-ng-4.3.5-0.20190717.0.el7ev.src.rpm
redhat-release-virtualization-host-4.3.5-2.el7ev.src.rpm

noarch:
imgbased-1.1.9-0.1.el7ev.noarch.rpm
ovirt-node-ng-nodectl-4.3.5-0.20190717.0.el7ev.noarch.rpm
python-imgbased-1.1.9-0.1.el7ev.noarch.rpm
python2-ovirt-node-ng-nodectl-4.3.5-0.20190717.0.el7ev.noarch.rpm
redhat-virtualization-host-image-update-placeholder-4.3.5-2.el7ev.noarch.rpm

x86_64:
redhat-release-virtualization-host-4.3.5-2.el7ev.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-16838
https://access.redhat.com/security/cve/CVE-2018-16881
https://access.redhat.com/security/cve/CVE-2019-0161
https://access.redhat.com/security/cve/CVE-2019-1559
https://access.redhat.com/security/cve/CVE-2019-10139
https://access.redhat.com/security/cve/CVE-2019-10160
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBXVFUTdzjgjWX9erEAQhvUg/+KuWuNcLr1x0BLbvWfJsuYMUckG6R0b7O
LMfzW85i56jNIEkQjgAx7srTkzdBd65Fs5/s03jrk7G9A2FAmtpob2Wle9TSb7Mj
L4n+1gomv8ecI7BB3FzmNT+TrE0jNL1oyYFp8Z7EBY2rRcTnssyDgZFQ4saCvIUQ
omAYhp1bb8s+U37/jXZr1JpsM0+ctiys1Z3hXXxessbXM1F39MjHz4KCeOl3qi9l
zpdA4dVFicBKEskV08K80id2GdWFDarynoA1ACCqSjU5FrPOGjzxcwxf2549RDGS
oE/ME93EP4P6a/PTzVuMGSikzk593I2WTqP+lN+t71XxpZVK95zuYe5RWJuRDYbs
uk70YXwaYLcuEghIRRA4kfu0m8FR4s3QAH+0VhbKzPWGZPDJOfJ0D7LDXIJ1KD5x
f+j8eMfi71EZAROp/0xix8qPWdKlaI9aQ7xZxzDY9agw9DolOK/WG76f2vUROsGO
lYF1nFPCbwewJVQKh7c7YRhvBkQ4L+SuENfuEN1jbrHPnqflndmwhf+1sZi1EyeT
fbvsC4qNSRrgTzbc3cBop13LH+WM7XKdX/MJcrLRug+jfcB73pt7L72DT4AK3JjU
2qry9rCZwCESairKCUaittFiNKBcNG9h13J563fXQGTJiW6Ji0t5fVpmnDXTv9nv
9xyXEwKutJk=
=xTlE
- -----END PGP SIGNATURE-----

- --------------------------END INCLUDED TEXT--------------------

You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.

NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members.  As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.

NOTE: This is only the original release of the security bulletin.  It may
not be updated when updates to the original are made.  If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.

Contact information for the authors of the original document is included
in the Security Bulletin above.  If you have any questions or need further
information, please contact them directly.

Previous advisories and external security bulletins can be retrieved from:

        https://www.auscert.org.au/bulletins/

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQIVAwUBXVIEv2aOgq3Tt24GAQj6XRAAm4VQHvQ9Es6yNEtyaoScu9b8cajtkvLe
bwyN1hrngpRS/QAl/zerhrD6sfrh7kthrhIgKBRWQHzI1wyiGYwQdovETh0H2+Wv
fXzONd2mXbR4UzQYNWJ3jo024vPVQJKdw2PLEtI1yhvT4mMHLQi61QgakYJYD8c1
JRyO4CYSfhiIdppjoNp8onz0mdPBiS7mTyzMrV5LfM0yUTK1k1M4iEQJY7rHrbYB
fnvwS9v/xUP6aUqxI1x0Mzm5EbxQxnqH63o5V5AexBAQK1OHXOXuMjV3fuKamMSg
6rTSPmAvmA692GoSRFzOqYzN2xcHGtPxdeh6UMx1xlMLyXs4VABveyjw01Uwi4k9
T8nlPvnucav0MYLiDRTav+id/NqrqlmEdUlCAmZJ194GoINVwXJBgMa6Zz5qqPlz
aPBp94CjaHZDcszVENt6T4E1Q1OzDUsBQaGmd36RwJp/7/Lsa3RthRVs4FE5KLnO
Jtx09XTzniOUicBzirahtK67KHpBwkkoqA5izoGLBNB6IOvjOdTXq2fz66Dj4VYc
toOJgd2/GUI60W63NjvD9JcMNpxg1HSGdl+SYoi5P6jJCCX/RUp+IYbhOBkvq71A
edFJ6pXug7Kq/mC4webMwjvZLAo50nrYzur8wv9pIuxHvBpVasnDTtjQILWCFDG2
ZEbj1MSKxwo=
=maB9
-----END PGP SIGNATURE-----