Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
Red Hat RHV Manager (ovirt-engine) Security Update Fixes Critical Flaw
published 2 years ago
Summary
A security issue was found in Red Hat RHV Manager (ovirt-engine) that could allow an attacker to execute arbitrary code. This issue affects the RHV Manager, a critical component of Red Hat Virtualization. To protect your system, apply the latest security update.
What to do
- Update redhat ovirt-engine to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-backend to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-dbscripts to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-health-check-bundler to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-restapi to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-setup to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-setup-base to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-setup-plugin-cinderlib to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-setup-plugin-imageio to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-setup-plugin-ovirt-engine to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-setup-plugin-ovirt-engine-common to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-setup-plugin-vmconsole-proxy-helper to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-setup-plugin-websocket-proxy to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-tools to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-tools-backup to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-vmconsole-proxy-helper to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-webadmin-portal to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-engine-websocket-proxy to version 0:4.5.2.4-0.1.el8ev.
- Update redhat python3-ovirt-engine-lib to version 0:4.5.2.4-0.1.el8ev.
- Update redhat rhvm to version 0:4.5.2.4-0.1.el8ev.
- Update redhat ovirt-web-ui to version 0:1.9.1-1.el8ev.
- Update redhat ovirt-log-collector to version 0:4.4.7-2.el8ev.
- Update redhat ovirt-engine-ui-extensions to version 0:1.3.5-1.el8ev.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-backend |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-dbscripts |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-health-check-bundler |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-restapi |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-setup |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-setup-base |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-setup-plugin-cinderlib |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-setup-plugin-imageio |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-setup-plugin-ovirt-engine |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-setup-plugin-ovirt-engine-common |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-setup-plugin-vmconsole-proxy-helper |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-setup-plugin-websocket-proxy |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-tools |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-tools-backup |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-vmconsole-proxy-helper |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-webadmin-portal |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-websocket-proxy |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | python3-ovirt-engine-lib |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | rhvm |
< 0:4.5.2.4-0.1.el8ev Fix: upgrade to 0:4.5.2.4-0.1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-web-ui |
< 0:1.9.1-1.el8ev Fix: upgrade to 0:1.9.1-1.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-log-collector |
< 0:4.4.7-2.el8ev Fix: upgrade to 0:4.4.7-2.el8ev
|
| Red Hat:rhev_manager:4.4:el8 | redhat | ovirt-engine-ui-extensions |
< 0:1.3.5-1.el8ev Fix: upgrade to 0:1.3.5-1.el8ev
|
Original advisory text
Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update
References
- https://access.redhat.com/errata/RHSA-2022:6393 Vendor Advisory
- https://access.redhat.com/security/updates/classification/#important Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1828406 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1850004 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1939284 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1944286 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1955388 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1974974 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2034584 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2080005 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2092478 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2094577 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2097536 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2097558 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2097560 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2097725 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2104115 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2104831 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2104939 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2105075 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2107250 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2107267 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2108985 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2109923 Third Party Advisory
- https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6393.j... Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2020-11022 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-11022 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-11022 Vendor Advisory
- https://github.com/advisories/GHSA-gxr4-xjj5-5px2 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2020-11023 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-11023 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-11023 Vendor Advisory
- https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/ Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog Third Party Advisory
- https://access.redhat.com/security/cve/CVE-2021-22096 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-22096 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-22096 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2021-23358 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2021-23358 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-23358 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-2806 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-2806 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-2806 Vendor Advisory
- https://access.redhat.com/security/cve/CVE-2022-31129 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2022-31129 Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-31129 Vendor Advisory
- https://github.com/moment/moment/security/advisories/GHSA-wc69-rhjr-hc9g Third Party Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically (estimated)
- Gives an attacker partial control (estimated)
Timeline
Published30 Sep 2024
Updated6 Mar 2026
First seen6 Mar 2026
Sources
RHSA-2022:6393 · OSV
Track software like this
Free during beta