Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
===========================================================================
AUSCERT External Security Bulletin Redistribution
ESB-2019.4146
virt-manager security, bug fix, and enhancement update
6 November 2019
===========================================================================
AusCERT Security Bulletin Summary
---------------------------------
Product: virt-manager
Publisher: Red Hat
Operating System: Red Hat Enterprise Linux Server 8
Red Hat Enterprise Linux WS/Desktop 8
Linux variants
Impact/Access: Access Confidential Data -- Existing Account
Resolution: Patch/Upgrade
CVE Names: CVE-2019-10183
Original Bulletin:
https://access.redhat.com/errata/RHSA-2019:3464
Comment: This advisory references vulnerabilities in products which run on
platforms other than Red Hat. It is recommended that administrators
running virt-manager check for an updated version of the software
for their operating system.
- --------------------------BEGIN INCLUDED TEXT--------------------
- -----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256
=====================================================================
Red Hat Security Advisory
Synopsis: Low: virt-manager security, bug fix, and enhancement update
Advisory ID: RHSA-2019:3464-01
Product: Red Hat Enterprise Linux
Advisory URL: https://access.redhat.com/errata/RHSA-2019:3464
Issue date: 2019-11-05
CVE Names: CVE-2019-10183
=====================================================================
1. Summary:
An update for virt-manager is now available for Red Hat Enterprise Linux 8.
Red Hat Product Security has rated this update as having a security impact
of Low. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.
2. Relevant releases/architectures:
Red Hat Enterprise Linux AppStream (v. 8) - noarch
3. Description:
Virtual Machine Manager (virt-manager) is a graphical tool for
administering virtual machines for KVM, Xen, and Linux Containers (LXC).
The virt-manager utility uses the libvirt API and can start, stop, add or
remove virtualized devices, connect to a graphical or serial console, and
view resource usage statistics for existing virtualized guests on local or
remote machines.
The following packages have been upgraded to a later upstream version:
virt-manager (2.2.1). (BZ#1727881)
Security Fix(es):
* virt-install: unattended option leaks password via command line argument
(CVE-2019-10183)
For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.
Additional Changes:
For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.1 Release Notes linked from the References section.
4. Solution:
For details on how to apply this update, which includes the changes
described in this advisory, refer to:
https://access.redhat.com/articles/11258
5. Bugs fixed (https://bugzilla.redhat.com/):
1599139 - RFE: Support genid in virt-manager
1659354 - video devices should be removeable when vm has more than one video devices
1660123 - No spice channel is added for Windows guests
1660467 - Can create a new vm with the MAC address in use on rhel8.0
1661867 - Cannot add a new virtual network: SR-IOV VF pool on rhel8
1666597 - Cannot enable or disable system tray icon
1667025 - Cannot modify guest's name on uefi firmware when creating new vm on rhel 8
1671599 - 'Allocation' under Storage volume quota for qcow2 format volume is redundant
1679018 - RuntimeError: Path does not exist: /var/lib/libvirt/qemu/nvram/test_VARS.fd
1683609 - [RFE] virt-install should add input devices when graphics are enabled
1690685 - Fail to force clone an empty cdrom device
1690687 - Fail to update graphic listen type by virt-xml
1692489 - virt-install fails with "Storage pool not found: no storage pool with matching name 'default'"
1700354 - warn if use of secboot UEFI will overwrite machine to q35
1707379 - virt-install with --sysinfo type=random-string silently defaults to smbios
1709857 - RFE - Ability to add IBPB feature policy to mitigate Spectre v2 for VM guests
1714304 - virt-install --os-variant rhel7 causes stack trace
1718065 - Drop virt-convert from rhel8
1722820 - missing gtksourceview3 dependency
1724287 - Using --wait 0 option in virt-install will return with exit code 1
1726232 - CVE-2019-10183 virt-install: unattended option leaks password via command line argument
1727811 - WARNING Changing machine type from '%s' to 'q35' which is required for UEFI secure boot
1727881 - Rebase virt-manager to current upstream release
1741846 - virt-install man page typo issue for "--launchSecurity" option
6. Package List:
Red Hat Enterprise Linux AppStream (v. 8):
Source:
virt-manager-2.2.1-2.el8.src.rpm
noarch:
virt-install-2.2.1-2.el8.noarch.rpm
virt-manager-2.2.1-2.el8.noarch.rpm
virt-manager-common-2.2.1-2.el8.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/
7. References:
https://access.redhat.com/security/cve/CVE-2019-10183
https://access.redhat.com/security/updates/classification/#low
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.1_release_notes/
8. Contact:
The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/
Copyright 2019 Red Hat, Inc.
- -----BEGIN PGP SIGNATURE-----
Version: GnuPG v1
iQIUAwUBXcHprdzjgjWX9erEAQgtcA/4zzBlgY4u903iiXL1kzzlmZbCWdiH3OXy
SGwW90MIjBTrToaUQ1Ix1y9cdDYqaUM+tlYwNy8tC7El/nULW+Le2M5BNxc9iAce
fIF6Sqlut+nZkFxP5q5kxndZMrPzqLZAGO9sP1p+Ma6P4IxHmMB7+z/0qRwbQHD+
Iz2M+mxm3EunPZYF330zoYAj2udBDLPNKV4c2JVauz1DzOkfihdUXyjr/k9/Shee
VUoIuBDk7Tk3WWlRdp/iRk9osQYwERP068lr19hfVSA0npHTM08WgV/4N097/1Fb
fFMYvbQD+et2yO8tdcqoScBjC/c2usVw7iEJts9xpZM/TD3CJ0wBBEoNh7b/S72o
fEqGBsmt5R/AT3r85JeWYwnFHCyQlL/e8CIigMufSZKdCYku51LDn2s8AixtSC3Y
JB8URmw40omu0ETz2W/nhIOpUh8tq1hEIjD8RxwmS5KKz6WKUPmCkQbo5W0U54vA
ecRtXLYGr9+zJvO1XLBT4HDZgUtQa/zA5ZOPB5sK9SKiTgP/dPgSc/FmgWGnqjNs
QEgxFwOThuiO6UoQamOAJ6ZzGtjVgZNg4ppMNXjmiz/qfujF3yG9pnkGPhdcPl78
rYhvjgMmsjzM5Op1hsN2QV3bJ6P4xmEwdSsehEbc4tPtB6ag3cUmK7VxJCjTiN2i
FRy1Z1FmdQ==
=5uBQ
- -----END PGP SIGNATURE-----
- --------------------------END INCLUDED TEXT--------------------
You have received this e-mail bulletin as a result of your organisation's
registration with AusCERT. The mailing list you are subscribed to is
maintained within your organisation, so if you do not wish to continue
receiving these bulletins you should contact your local IT manager. If
you do not know who that is, please send an email to auscert@auscert.org.au
and we will forward your request to the appropriate person.
NOTE: Third Party Rights
This security bulletin is provided as a service to AusCERT's members. As
AusCERT did not write the document quoted above, AusCERT has had no control
over its content. The decision to follow or act on information or advice
contained in this security bulletin is the responsibility of each user or
organisation, and should be considered in accordance with your organisation's
site policies and procedures. AusCERT takes no responsibility for consequences
which may arise from following or acting on information or advice contained in
this security bulletin.
NOTE: This is only the original release of the security bulletin. It may
not be updated when updates to the original are made. If downloading at
a later date, it is recommended that the bulletin is retrieved directly
from the author's website to ensure that the information is still current.
Contact information for the authors of the original document is included
in the Security Bulletin above. If you have any questions or need further
information, please contact them directly.
Previous advisories and external security bulletins can be retrieved from:
https://www.auscert.org.au/bulletins/
===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072
Internet Email: auscert@auscert.org.au
Facsimile: (07) 3365 7031
Telephone: (07) 3365 4417 (International: +61 7 3365 4417)
AusCERT personnel answer during Queensland business hours
which are GMT+10:00 (AEST).
On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967
iQIVAwUBXcJGQ2aOgq3Tt24GAQhWLRAAnD7D70TcJZhbuNuXexL93xUTq6d/Pcgh
3M8C0D2dfKMuFNGBagLAHHa0O33UK8PFYGGiesjgvnhDDEG+phHBEwV2oDjE+1a9
RlltJjxjfHPX3gkaPwTy9chxk1HN4l7mcTIPtErynWXnw3LP4phe4QHxd7NEu4H5
ASG9Va+fh4qNCUm7IXFrGZC7GIoOnCA2+I0PWBJPMYjuwNZo0yJsYxqgEBMfdY/N
c9arqBy27aGO8Dr5YwAuIbLga380FTVmuxmKep106NTQjyVDgTTPwws2EEEHlNas
JSVcRdOVQ39xUZaNnw8IrlX/ze0Q/Gc+NT+4dV1/SSUtjjka6xbgdSQyFW1C9G4b
r5uNdbjWcuDire1hiOYcz6NfFoQ8FToeavNN0Ut80o8toCCX3om31KCJNa7/thBz
qrzzcx1ElQ9ksp1bR30qM1zDVfNUPKDLVxN5TtKQsbN2LjOstNlqwuFBUFcmERuA
Z8SmCOOh8vbSTx4JvnMD3BiJ+Tjf6ahV96wOkdqrYxw0XKk7jxbppoEjl9Gm33D9
owFHiSbtcwr5Uzym1LE1plLksXWar5N1Np57fAi/z/SN2q8y1H5/Vmh9Orq/iPjN
pwODTh+Qix9Nd351CDHlxxIwJCQm3EzVhzW+x8pG7FECuQQ9iVQGcOxqV9KGQp0o
gD5awiZnYAY=
=jKAq
-----END PGP SIGNATURE-----