RHSA-2021:1169
Vulnerability from csaf_redhat
Published
2021-04-14 16:34
Modified
2025-02-06 23:24
Summary
Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement
Notes
Topic
An update is now available for Red Hat Virtualization Engine 4.4.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The ovirt-engine package provides the manager for virtualization environments.
This manager enables admins to define hosts and networks, as well as to add
storage, create VMs and manage user permissions.
A list of bugs fixed in this update is available in the Technical Notes
book:
https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes
Security Fix(es):
* nodejs-bootstrap-select: not escaping title values on <option> may lead to XSS (CVE-2019-20921)
* m2crypto: bleichenbacher timing attacks in the RSA decryption API (CVE-2020-25657)
* datatables.net: prototype pollution if 'constructor' were used in a data property name (CVE-2020-28458)
* nodejs-immer: prototype pollution may lead to DoS or remote code execution (CVE-2020-28477)
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat Virtualization Engine 4.4.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "The ovirt-engine package provides the manager for virtualization environments.\nThis manager enables admins to define hosts and networks, as well as to add\nstorage, create VMs and manage user permissions.\n\nA list of bugs fixed in this update is available in the Technical Notes\nbook:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes\n\nSecurity Fix(es):\n\n* nodejs-bootstrap-select: not escaping title values on \u003coption\u003e may lead to XSS (CVE-2019-20921)\n\n* m2crypto: bleichenbacher timing attacks in the RSA decryption API (CVE-2020-25657)\n\n* datatables.net: prototype pollution if \u0027constructor\u0027 were used in a data property name (CVE-2020-28458)\n\n* nodejs-immer: prototype pollution may lead to DoS or remote code execution (CVE-2020-28477)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2021:1169",
"url": "https://access.redhat.com/errata/RHSA-2021:1169"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes",
"url": "https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes"
},
{
"category": "external",
"summary": "1145658",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1145658"
},
{
"category": "external",
"summary": "1155275",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1155275"
},
{
"category": "external",
"summary": "1649479",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1649479"
},
{
"category": "external",
"summary": "1666786",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1666786"
},
{
"category": "external",
"summary": "1688186",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688186"
},
{
"category": "external",
"summary": "1729359",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1729359"
},
{
"category": "external",
"summary": "1787235",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1787235"
},
{
"category": "external",
"summary": "1802844",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1802844"
},
{
"category": "external",
"summary": "1837221",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1837221"
},
{
"category": "external",
"summary": "1843882",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1843882"
},
{
"category": "external",
"summary": "1858420",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1858420"
},
{
"category": "external",
"summary": "1882273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882273"
},
{
"category": "external",
"summary": "1884233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1884233"
},
{
"category": "external",
"summary": "1889823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889823"
},
{
"category": "external",
"summary": "1895217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1895217"
},
{
"category": "external",
"summary": "1901503",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901503"
},
{
"category": "external",
"summary": "1901752",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901752"
},
{
"category": "external",
"summary": "1905108",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1905108"
},
{
"category": "external",
"summary": "1905158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1905158"
},
{
"category": "external",
"summary": "1908441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908441"
},
{
"category": "external",
"summary": "1910302",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1910302"
},
{
"category": "external",
"summary": "1913198",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1913198"
},
{
"category": "external",
"summary": "1914602",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1914602"
},
{
"category": "external",
"summary": "1918162",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1918162"
},
{
"category": "external",
"summary": "1919555",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1919555"
},
{
"category": "external",
"summary": "1921104",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921104"
},
{
"category": "external",
"summary": "1921119",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1921119"
},
{
"category": "external",
"summary": "1922200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1922200"
},
{
"category": "external",
"summary": "1924012",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1924012"
},
{
"category": "external",
"summary": "1926854",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926854"
},
{
"category": "external",
"summary": "1927851",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1927851"
},
{
"category": "external",
"summary": "1931514",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1931514"
},
{
"category": "external",
"summary": "1931786",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1931786"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1169.json"
}
],
"title": "Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement",
"tracking": {
"current_release_date": "2025-02-06T23:24:41+00:00",
"generator": {
"date": "2025-02-06T23:24:41+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.3.0"
}
},
"id": "RHSA-2021:1169",
"initial_release_date": "2021-04-14T16:34:39+00:00",
"revision_history": [
{
"date": "2021-04-14T16:34:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2021-04-14T16:34:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-02-06T23:24:41+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product": {
"name": "RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhev_manager:4.4:el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "apache-sshd-0:2.6.0-1.el8ev.src",
"product": {
"name": "apache-sshd-0:2.6.0-1.el8ev.src",
"product_id": "apache-sshd-0:2.6.0-1.el8ev.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-sshd@2.6.0-1.el8ev?arch=src"
}
}
},
{
"category": "product_version",
"name": "ansible-runner-service-0:1.0.7-1.el8ev.src",
"product": {
"name": "ansible-runner-service-0:1.0.7-1.el8ev.src",
"product_id": "ansible-runner-service-0:1.0.7-1.el8ev.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-runner-service@1.0.7-1.el8ev?arch=src"
}
}
},
{
"category": "product_version",
"name": "ansible-runner-0:1.4.6-2.el8ar.src",
"product": {
"name": "ansible-runner-0:1.4.6-2.el8ar.src",
"product_id": "ansible-runner-0:1.4.6-2.el8ar.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-runner@1.4.6-2.el8ar?arch=src"
}
}
},
{
"category": "product_version",
"name": "ovirt-web-ui-0:1.6.7-1.el8ev.src",
"product": {
"name": "ovirt-web-ui-0:1.6.7-1.el8ev.src",
"product_id": "ovirt-web-ui-0:1.6.7-1.el8ev.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-web-ui@1.6.7-1.el8ev?arch=src"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"product": {
"name": "ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"product_id": "ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-dwh@4.4.5.5-1.el8ev?arch=src"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"product": {
"name": "ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"product_id": "ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine@4.4.5.9-0.1.el8ev?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "apache-sshd-0:2.6.0-1.el8ev.noarch",
"product": {
"name": "apache-sshd-0:2.6.0-1.el8ev.noarch",
"product_id": "apache-sshd-0:2.6.0-1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-sshd@2.6.0-1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"product": {
"name": "apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"product_id": "apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/apache-sshd-javadoc@2.6.0-1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"product": {
"name": "ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"product_id": "ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-runner-service@1.0.7-1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ansible-runner-0:1.4.6-2.el8ar.noarch",
"product": {
"name": "ansible-runner-0:1.4.6-2.el8ar.noarch",
"product_id": "ansible-runner-0:1.4.6-2.el8ar.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ansible-runner@1.4.6-2.el8ar?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"product": {
"name": "python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"product_id": "python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-ansible-runner@1.4.6-2.el8ar?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"product": {
"name": "ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"product_id": "ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-web-ui@1.6.7-1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"product": {
"name": "ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"product_id": "ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-dwh@4.4.5.5-1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"product": {
"name": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"product_id": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-dwh-grafana-integration-setup@4.4.5.5-1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"product": {
"name": "ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"product_id": "ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-dwh-setup@4.4.5.5-1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-backend@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-dbscripts@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-health-check-bundler@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-restapi@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-setup@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-setup-base@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-cinderlib@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-imageio@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-ovirt-engine@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-ovirt-engine-common@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-vmconsole-proxy-helper@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-websocket-proxy@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-tools@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-tools-backup@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-vmconsole-proxy-helper@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-webadmin-portal@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ovirt-engine-websocket-proxy@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/python3-ovirt-engine-lib@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhvm-0:4.4.5.9-0.1.el8ev.noarch",
"product": {
"name": "rhvm-0:4.4.5.9-0.1.el8ev.noarch",
"product_id": "rhvm-0:4.4.5.9-0.1.el8ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhvm@4.4.5.9-0.1.el8ev?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-runner-0:1.4.6-2.el8ar.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch"
},
"product_reference": "ansible-runner-0:1.4.6-2.el8ar.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-runner-0:1.4.6-2.el8ar.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src"
},
"product_reference": "ansible-runner-0:1.4.6-2.el8ar.src",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-runner-service-0:1.0.7-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch"
},
"product_reference": "ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ansible-runner-service-0:1.0.7-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src"
},
"product_reference": "ansible-runner-service-0:1.0.7-1.el8ev.src",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-sshd-0:2.6.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch"
},
"product_reference": "apache-sshd-0:2.6.0-1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-sshd-0:2.6.0-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src"
},
"product_reference": "apache-sshd-0:2.6.0-1.el8ev.src",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch"
},
"product_reference": "apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-0:4.4.5.9-0.1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src"
},
"product_reference": "ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch"
},
"product_reference": "ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src"
},
"product_reference": "ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch"
},
"product_reference": "ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch"
},
"product_reference": "ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-web-ui-0:1.6.7-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch"
},
"product_reference": "ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ovirt-web-ui-0:1.6.7-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src"
},
"product_reference": "ovirt-web-ui-0:1.6.7-1.el8ev.src",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-ansible-runner-0:1.4.6-2.el8ar.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch"
},
"product_reference": "python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhvm-0:4.4.5.9-0.1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4",
"product_id": "8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
},
"product_reference": "rhvm-0:4.4.5.9-0.1.el8ev.noarch",
"relates_to_product_reference": "8Base-RHV-S-4.4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2019-20921",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2020-09-24T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1882273"
}
],
"notes": [
{
"category": "description",
"text": "bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim\u0027s browser.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-bootstrap-select: not escaping title values on \u003coption\u003e may lead to XSS",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "In OpenShift Service Mesh (OSSM) the openshift-service-mesh/kiali-rhel7 container (which installs the kiali rpm) is behind OpenShift OAuth authentication restricting access to the vulnerable bootstrap-select library to authenticated users only, therefore the impact is low.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src"
],
"known_not_affected": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2019-20921"
},
{
"category": "external",
"summary": "RHBZ#1882273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882273"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2019-20921",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-20921"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-20921",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-20921"
},
{
"category": "external",
"summary": "https://github.com/advisories/GHSA-9r7h-6639-v5mw",
"url": "https://github.com/advisories/GHSA-9r7h-6639-v5mw"
},
{
"category": "external",
"summary": "https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457",
"url": "https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457"
}
],
"release_date": "2019-02-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-04-14T16:34:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
"product_ids": [
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1169"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "nodejs-bootstrap-select: not escaping title values on \u003coption\u003e may lead to XSS"
},
{
"cve": "CVE-2020-25657",
"cwe": {
"id": "CWE-203",
"name": "Observable Discrepancy"
},
"discovery_date": "2020-10-19T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1889823"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in the RSA decryption API via the timed processing of valid PKCS#1 v1.5 Ciphertext. The highest threat from this vulnerability is to confidentiality.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "m2crypto: bleichenbacher timing attacks in the RSA decryption API",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
],
"known_not_affected": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-25657"
},
{
"category": "external",
"summary": "RHBZ#1889823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889823"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-25657",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-25657"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25657",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25657"
}
],
"release_date": "2020-11-13T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-04-14T16:34:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
"product_ids": [
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1169"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "m2crypto: bleichenbacher timing attacks in the RSA decryption API"
},
{
"cve": "CVE-2020-28458",
"cwe": {
"id": "CWE-400",
"name": "Uncontrolled Resource Consumption"
},
"discovery_date": "2020-12-16T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1908441"
}
],
"notes": [
{
"category": "description",
"text": "All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "datatables.net: prototype pollution if \u0027constructor\u0027 were used in a data property name",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "OpenShift console container does package a vulnerable version of datatables.net, however as access to the vulnerable component is restricted via OpenShift OAuth the vulnerability is rated with an impact of `Low`.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src"
],
"known_not_affected": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-28458"
},
{
"category": "external",
"summary": "RHBZ#1908441",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1908441"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-28458",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28458"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28458",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28458"
},
{
"category": "external",
"summary": "https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402",
"url": "https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402"
}
],
"release_date": "2020-10-25T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-04-14T16:34:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
"product_ids": [
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1169"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "datatables.net: prototype pollution if \u0027constructor\u0027 were used in a data property name"
},
{
"cve": "CVE-2020-28477",
"cwe": {
"id": "CWE-915",
"name": "Improperly Controlled Modification of Dynamically-Determined Object Attributes"
},
"discovery_date": "2021-01-20T00:00:00+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1918162"
}
],
"notes": [
{
"category": "description",
"text": "This affects all versions of package immer.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "nodejs-immer: prototype pollution may lead to DoS or remote code execution",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Virtualization includes affected version of nodejs-immer, however the usage does not meet the conditions required to exploit the flaw, therefore the impact is Low.\n\nIn OpenShift Container Platform 4.6 (OCP) the openshift4/ose-prometheus container ships the vulnerable version of the nodejs-immer, however the Prometheus react-ui is disabled, hence this flaw cannot be exploited. As openshift4/ose-prometheus container still packages the vulnerable code, this component is affected with impact Low. This may be fixed in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src"
],
"known_not_affected": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2020-28477"
},
{
"category": "external",
"summary": "RHBZ#1918162",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1918162"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2020-28477",
"url": "https://www.cve.org/CVERecord?id=CVE-2020-28477"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28477",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28477"
},
{
"category": "external",
"summary": "https://snyk.io/vuln/SNYK-JS-IMMER-1019369",
"url": "https://snyk.io/vuln/SNYK-JS-IMMER-1019369"
}
],
"release_date": "2021-01-19T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2021-04-14T16:34:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
"product_ids": [
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2021:1169"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:ansible-runner-0:1.4.6-2.el8ar.src",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ansible-runner-service-0:1.0.7-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:apache-sshd-0:2.6.0-1.el8ev.src",
"8Base-RHV-S-4.4:apache-sshd-javadoc-0:2.6.0-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-0:4.4.5.9-0.1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-backend-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dbscripts-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-0:4.4.5.5-1.el8ev.src",
"8Base-RHV-S-4.4:ovirt-engine-dwh-grafana-integration-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-dwh-setup-0:4.4.5.5-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-health-check-bundler-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-restapi-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-base-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-cinderlib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-imageio-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-setup-plugin-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-tools-backup-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-vmconsole-proxy-helper-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-webadmin-portal-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-engine-websocket-proxy-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.noarch",
"8Base-RHV-S-4.4:ovirt-web-ui-0:1.6.7-1.el8ev.src",
"8Base-RHV-S-4.4:python3-ansible-runner-0:1.4.6-2.el8ar.noarch",
"8Base-RHV-S-4.4:python3-ovirt-engine-lib-0:4.4.5.9-0.1.el8ev.noarch",
"8Base-RHV-S-4.4:rhvm-0:4.4.5.9-0.1.el8ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "nodejs-immer: prototype pollution may lead to DoS or remote code execution"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.