Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

Red Hat Virtualization Host: Remote Code Execution Risk

published 2 years ago

Summary

A security update is available for Red Hat Virtualization Host to fix a vulnerability that could allow an attacker to execute code remotely. This affects all supported versions of Red Hat Virtualization Host. To protect your system, apply the latest update as soon as possible.

What to do

Update redhat redhat-release-virtualization-host to version 0:4.2-8.6.el7.
Update redhat redhat-release-virtualization-host-content to version 0:4.2-8.6.el7.
Update redhat redhat-virtualization-host to version 0:4.2-20190512.0.el7_6.
Update redhat redhat-virtualization-host-image-update to version 0:4.2-20190512.0.el7_6.
Update redhat redhat-virtualization-host-image-update-placeholder to version 0:4.2-8.6.el7.

Affected software

Ecosystem	Vendor	Product	Affected versions
Red Hat:enterprise_linux:7::hypervisor	redhat	redhat-release-virtualization-host	< 0:4.2-8.6.el7 Fix: upgrade to 0:4.2-8.6.el7
Red Hat:enterprise_linux:7::hypervisor	redhat	redhat-release-virtualization-host-content	< 0:4.2-8.6.el7 Fix: upgrade to 0:4.2-8.6.el7
Red Hat:enterprise_linux:7::hypervisor	redhat	redhat-virtualization-host	< 0:4.2-20190512.0.el7_6 Fix: upgrade to 0:4.2-20190512.0.el7_6
Red Hat:enterprise_linux:7::hypervisor	redhat	redhat-virtualization-host-image-update	< 0:4.2-20190512.0.el7_6 Fix: upgrade to 0:4.2-20190512.0.el7_6
Red Hat:enterprise_linux:7::hypervisor	redhat	redhat-virtualization-host-image-update-placeholder	< 0:4.2-8.6.el7 Fix: upgrade to 0:4.2-8.6.el7

Original advisory text

Red Hat Security Advisory: redhat-virtualization-host security update

References

https://access.redhat.com/errata/RHSA-2019:1209 Vendor Advisory
https://access.redhat.com/security/vulnerabilities/mds Third Party Advisory
https://access.redhat.com/security/updates/classification/#important Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1646781 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1646784 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1667782 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1705312 Third Party Advisory
https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1209.j... Vendor Advisory
https://access.redhat.com/security/cve/CVE-2018-12126 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-12126 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-12126 Vendor Advisory
https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00233.... Third Party Advisory
https://access.redhat.com/security/cve/CVE-2018-12127 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-12127 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-12127 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2018-12130 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2018-12130 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2018-12130 Vendor Advisory
https://access.redhat.com/security/cve/CVE-2019-11091 Third Party Advisory
https://www.cve.org/CVERecord?id=CVE-2019-11091 Vendor Advisory
https://nvd.nist.gov/vuln/detail/CVE-2019-11091 Vendor Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

6.5 Medium

Timeline

Published13 Sep 2024

Updated6 Mar 2026

First seen6 Mar 2026

Sources

RHSA-2019:1209 · OSV

Track software like this

Free during beta