Action not permitted
Modal body text goes here.
CVE-2019-17195
Vulnerability from cvelistv5
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-05T01:33:17.304Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "[hadoop-common-issues] 20191107 [jira] [Created] (HADOOP-16690) Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41%40%3Ccommon-issues.hadoop.apache.org%3E" }, { "name": "[hadoop-common-dev] 20191107 [jira] [Created] (HADOOP-16690) Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d%40%3Ccommon-dev.hadoop.apache.org%3E" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://connect2id.com/blog/nimbus-jose-jwt-7-9" }, { "name": "[avro-dev] 20210415 [jira] [Created] (AVRO-3111) CVE-2019-17195", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98%40%3Cdev.avro.apache.org%3E" }, { "name": "[avro-dev] 20210416 [jira] [Commented] (AVRO-3111) CVE-2019-17195", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a%40%3Cdev.avro.apache.org%3E" }, { "name": "[druid-commits] 20210506 [GitHub] [druid] jihoonson commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b%40%3Ccommits.druid.apache.org%3E" }, { "name": "[druid-commits] 20210506 [GitHub] [druid] maytasm commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2%40%3Ccommits.druid.apache.org%3E" }, { "name": "[druid-commits] 20210507 [druid] branch 0.21.1 updated: Suppressing false positive CVE-2020-7791 (#11215) (#11217)", "tags": [ "mailing-list", "x_refsource_MLIST", "x_transferred" ], "url": "https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d%40%3Ccommits.druid.apache.org%3E" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "descriptions": [ { "lang": "en", "value": "Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2022-04-19T23:20:20", "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre" }, "references": [ { "name": "[hadoop-common-issues] 20191107 [jira] [Created] (HADOOP-16690) Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41%40%3Ccommon-issues.hadoop.apache.org%3E" }, { "name": "[hadoop-common-dev] 20191107 [jira] [Created] (HADOOP-16690) Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d%40%3Ccommon-dev.hadoop.apache.org%3E" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://connect2id.com/blog/nimbus-jose-jwt-7-9" }, { "name": "[avro-dev] 20210415 [jira] [Created] (AVRO-3111) CVE-2019-17195", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98%40%3Cdev.avro.apache.org%3E" }, { "name": "[avro-dev] 20210416 [jira] [Commented] (AVRO-3111) CVE-2019-17195", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a%40%3Cdev.avro.apache.org%3E" }, { "name": "[druid-commits] 20210506 [GitHub] [druid] jihoonson commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b%40%3Ccommits.druid.apache.org%3E" }, { "name": "[druid-commits] 20210506 [GitHub] [druid] maytasm commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2%40%3Ccommits.druid.apache.org%3E" }, { "name": "[druid-commits] 20210507 [druid] branch 0.21.1 updated: Suppressing false positive CVE-2020-7791 (#11215) (#11217)", "tags": [ "mailing-list", "x_refsource_MLIST" ], "url": "https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d%40%3Ccommits.druid.apache.org%3E" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "tags": [ "x_refsource_MISC" ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-17195", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "[hadoop-common-issues] 20191107 [jira] [Created] (HADOOP-16690) Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41@%3Ccommon-issues.hadoop.apache.org%3E" }, { "name": "[hadoop-common-dev] 20191107 [jira] [Created] (HADOOP-16690) Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d@%3Ccommon-dev.hadoop.apache.org%3E" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2020.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "name": "https://www.oracle.com/security-alerts/cpujan2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "name": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt", "refsource": "CONFIRM", "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt" }, { "name": "https://connect2id.com/blog/nimbus-jose-jwt-7-9", "refsource": "CONFIRM", "url": "https://connect2id.com/blog/nimbus-jose-jwt-7-9" }, { "name": "[avro-dev] 20210415 [jira] [Created] (AVRO-3111) CVE-2019-17195", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98@%3Cdev.avro.apache.org%3E" }, { "name": "[avro-dev] 20210416 [jira] [Commented] (AVRO-3111) CVE-2019-17195", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a@%3Cdev.avro.apache.org%3E" }, { "name": "[druid-commits] 20210506 [GitHub] [druid] jihoonson commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b@%3Ccommits.druid.apache.org%3E" }, { "name": "[druid-commits] 20210506 [GitHub] [druid] maytasm commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2@%3Ccommits.druid.apache.org%3E" }, { "name": "[druid-commits] 20210507 [druid] branch 0.21.1 updated: Suppressing false positive CVE-2020-7791 (#11215) (#11217)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d@%3Ccommits.druid.apache.org%3E" }, { "name": "https://www.oracle.com/security-alerts/cpuApr2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "name": "https://www.oracle.com//security-alerts/cpujul2021.html", "refsource": "MISC", "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "name": "https://www.oracle.com/security-alerts/cpuoct2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "name": "https://www.oracle.com/security-alerts/cpujan2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "cveId": "CVE-2019-17195", "datePublished": "2019-10-15T13:42:34", "dateReserved": "2019-10-05T00:00:00", "dateUpdated": "2024-08-05T01:33:17.304Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2019-17195\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2019-10-15T14:15:12.380\",\"lastModified\":\"2023-11-07T03:06:11.280\",\"vulnStatus\":\"Modified\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.\"},{\"lang\":\"es\",\"value\":\"Connect2id Nimbus JOSE+JWT versiones anteriores a v7.9, puede arrojar varias excepciones no captadas al analizar un JWT, lo que podr\u00eda resultar en un bloqueo de la aplicaci\u00f3n (potencial divulgaci\u00f3n de informaci\u00f3n) o una posible omisi\u00f3n de autenticaci\u00f3n.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:P/I:P/A:P\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\",\"baseScore\":6.8},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-755\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:connect2id:nimbus_jose\\\\+jwt:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"7.9\",\"matchCriteriaId\":\"AB9A6F74-1242-4469-A93A-868688427450\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:apache:hadoop:3.2.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"B88C6164-4361-433D-9B88-3E039CC039AE\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"BD4349FE-EEF8-489A-8ABF-5FCD55EC6DE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D7B49D71-6A31-497A-B6A9-06E84F086E7A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FADE563-5AAA-42FF-B43F-35B20A2386C9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26F3E23-F1A9-45E7-9E5F-0C0A24EE3783\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"66C673C4-A825-46C0-816B-103E1C058D03\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"11.0\",\"versionEndIncluding\":\"11.3.1\",\"matchCriteriaId\":\"8E883986-13DA-470F-95C4-BEBD0EDFEB9C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"9.2.5.3\",\"matchCriteriaId\":\"B2A0A4A6-70D3-418B-80EA-04718C50C500\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"9.2.5.3\",\"matchCriteriaId\":\"0E561CFF-BB8A-4CFD-916D-4410A9265922\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9DB4A14-2EF5-4B54-95D2-75E6CF9AA0A9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8AF00C6-B97F-414D-A8DF-057E6BFD8597\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"12.2.0\",\"versionEndIncluding\":\"12.2.22\",\"matchCriteriaId\":\"225A30A4-90FD-4B3A-80C4-9871294C318E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"18.8.0\",\"versionEndIncluding\":\"18.8.11\",\"matchCriteriaId\":\"53E2276C-9515-46F6-A621-213A3047B9A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B201A85E-1310-46B8-8A3B-FF7675F84E09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:solaris_cluster:4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"87A83709-4D38-4844-8928-0C2D6F2033BD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F14A818F-AA16-4438-A3E4-E64C9287AC66\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4A5BB153-68E0-4DDA-87D1-0D9AB7F0A418\"}]}]}],\"references\":[{\"url\":\"https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Third Party Advisory\"]},{\"url\":\"https://connect2id.com/blog/nimbus-jose-jwt-7-9\",\"source\":\"cve@mitre.org\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d%40%3Ccommon-dev.hadoop.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41%40%3Ccommon-issues.hadoop.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2%40%3Ccommits.druid.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b%40%3Ccommits.druid.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a%40%3Cdev.avro.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d%40%3Ccommits.druid.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98%40%3Cdev.avro.apache.org%3E\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://www.oracle.com//security-alerts/cpujul2021.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuApr2021.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2020.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuapr2022.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2021.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpujan2022.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Not Applicable\"]},{\"url\":\"https://www.oracle.com/security-alerts/cpuoct2021.html\",\"source\":\"cve@mitre.org\",\"tags\":[\"Patch\",\"Third Party Advisory\"]}]}}" } }
gsd-2019-17195
Vulnerability from gsd
{ "GSD": { "alias": "CVE-2019-17195", "description": "Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.", "id": "GSD-2019-17195", "references": [ "https://access.redhat.com/errata/RHSA-2020:1308" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "aliases": [ "CVE-2019-17195" ], "details": "Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.", "id": "GSD-2019-17195", "modified": "2023-12-13T01:23:44.611439Z", "schema_version": "1.4.0" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-17195", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "[hadoop-common-issues] 20191107 [jira] [Created] (HADOOP-16690) Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41@%3Ccommon-issues.hadoop.apache.org%3E" }, { "name": "[hadoop-common-dev] 20191107 [jira] [Created] (HADOOP-16690) Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d@%3Ccommon-dev.hadoop.apache.org%3E" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2020.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "name": "https://www.oracle.com/security-alerts/cpujan2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "name": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt", "refsource": "CONFIRM", "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt" }, { "name": "https://connect2id.com/blog/nimbus-jose-jwt-7-9", "refsource": "CONFIRM", "url": "https://connect2id.com/blog/nimbus-jose-jwt-7-9" }, { "name": "[avro-dev] 20210415 [jira] [Created] (AVRO-3111) CVE-2019-17195", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98@%3Cdev.avro.apache.org%3E" }, { "name": "[avro-dev] 20210416 [jira] [Commented] (AVRO-3111) CVE-2019-17195", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a@%3Cdev.avro.apache.org%3E" }, { "name": "[druid-commits] 20210506 [GitHub] [druid] jihoonson commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b@%3Ccommits.druid.apache.org%3E" }, { "name": "[druid-commits] 20210506 [GitHub] [druid] maytasm commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2@%3Ccommits.druid.apache.org%3E" }, { "name": "[druid-commits] 20210507 [druid] branch 0.21.1 updated: Suppressing false positive CVE-2020-7791 (#11215) (#11217)", "refsource": "MLIST", "url": "https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d@%3Ccommits.druid.apache.org%3E" }, { "name": "https://www.oracle.com/security-alerts/cpuApr2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "name": "https://www.oracle.com//security-alerts/cpujul2021.html", "refsource": "MISC", "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "name": "https://www.oracle.com/security-alerts/cpuoct2021.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "name": "https://www.oracle.com/security-alerts/cpujan2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2022.html", "refsource": "MISC", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ] } }, "gitlab.com": { "advisories": [ { "affected_range": "(,7.9)", "affected_versions": "All versions before 7.9", "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "cwe_ids": [ "CWE-1035", "CWE-755", "CWE-937" ], "date": "2022-02-08", "description": "Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.", "fixed_versions": [ "7.9" ], "identifier": "CVE-2019-17195", "identifiers": [ "GHSA-f6vf-pq8c-69m4", "CVE-2019-17195" ], "not_impacted": "All versions starting from 7.9", "package_slug": "maven/com.nimbusds/nimbus-jose-jwt", "pubdate": "2019-10-16", "solution": "Upgrade to version 7.9 or above.", "title": "Improper Handling of Exceptional Conditions", "urls": [ "https://nvd.nist.gov/vuln/detail/CVE-2019-17195", "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt", "https://connect2id.com/blog/nimbus-jose-jwt-7-9", "https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d@%3Ccommon-dev.hadoop.apache.org%3E", "https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41@%3Ccommon-issues.hadoop.apache.org%3E", "https://www.oracle.com/security-alerts/cpuapr2020.html", "https://www.oracle.com/security-alerts/cpujan2021.html", "https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a@%3Cdev.avro.apache.org%3E", "https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98@%3Cdev.avro.apache.org%3E", "https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2@%3Ccommits.druid.apache.org%3E", "https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b@%3Ccommits.druid.apache.org%3E", "https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d@%3Ccommits.druid.apache.org%3E", "https://www.oracle.com/security-alerts/cpuApr2021.html", "https://www.oracle.com//security-alerts/cpujul2021.html", "https://www.oracle.com/security-alerts/cpuoct2021.html", "https://www.oracle.com/security-alerts/cpujan2022.html", "https://github.com/advisories/GHSA-f6vf-pq8c-69m4" ], "uuid": "b7daa485-3888-4264-966a-03d9c9e9a56e" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "7.9", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:apache:hadoop:3.2.1:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:oracle:solaris_cluster:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "18.8.11", "versionStartIncluding": "18.8.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "9.2.5.3", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "12.2.22", "versionStartIncluding": "12.2.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "11.3.1", "versionStartIncluding": "11.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "9.2.5.3", "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "cve@mitre.org", "ID": "CVE-2019-17195" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-755" } ] } ] }, "references": { "reference_data": [ { "name": "https://connect2id.com/blog/nimbus-jose-jwt-7-9", "refsource": "CONFIRM", "tags": [ "Release Notes", "Vendor Advisory" ], "url": "https://connect2id.com/blog/nimbus-jose-jwt-7-9" }, { "name": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt", "refsource": "CONFIRM", "tags": [ "Release Notes", "Third Party Advisory" ], "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt" }, { "name": "[hadoop-common-dev] 20191107 [jira] [Created] (HADOOP-16690) Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d@%3Ccommon-dev.hadoop.apache.org%3E" }, { "name": "[hadoop-common-issues] 20191107 [jira] [Created] (HADOOP-16690) Update dependency com.nimbusds:nimbus-jose-jwt due to security vulnerability", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41@%3Ccommon-issues.hadoop.apache.org%3E" }, { "name": "N/A", "refsource": "N/A", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "name": "https://www.oracle.com/security-alerts/cpujan2021.html", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "name": "[avro-dev] 20210415 [jira] [Created] (AVRO-3111) CVE-2019-17195", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98@%3Cdev.avro.apache.org%3E" }, { "name": "[avro-dev] 20210416 [jira] [Commented] (AVRO-3111) CVE-2019-17195", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a@%3Cdev.avro.apache.org%3E" }, { "name": "[druid-commits] 20210506 [GitHub] [druid] jihoonson commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b@%3Ccommits.druid.apache.org%3E" }, { "name": "[druid-commits] 20210506 [GitHub] [druid] maytasm commented on a change in pull request #11215: Suppressing false positive CVE-2020-7791", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2@%3Ccommits.druid.apache.org%3E" }, { "name": "[druid-commits] 20210507 [druid] branch 0.21.1 updated: Suppressing false positive CVE-2020-7791 (#11215) (#11217)", "refsource": "MLIST", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d@%3Ccommits.druid.apache.org%3E" }, { "name": "https://www.oracle.com/security-alerts/cpuApr2021.html", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "name": "N/A", "refsource": "N/A", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "name": "https://www.oracle.com/security-alerts/cpuoct2021.html", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "name": "https://www.oracle.com/security-alerts/cpujan2022.html", "refsource": "MISC", "tags": [ "Not Applicable" ], "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "name": "https://www.oracle.com/security-alerts/cpuapr2022.html", "refsource": "MISC", "tags": [ "Patch", "Third Party Advisory" ], "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" } ] } }, "impact": { "baseMetricV2": { "acInsufInfo": false, "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false }, "baseMetricV3": { "cvssV3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "exploitabilityScore": 3.9, "impactScore": 5.9 } }, "lastModifiedDate": "2022-06-07T18:40Z", "publishedDate": "2019-10-15T14:15Z" } } }
wid-sec-w-2022-0770
Vulnerability from csaf_certbund
Notes
{ "document": { "aggregate_severity": { "text": "hoch" }, "category": "csaf_base", "csaf_version": "2.0", "distribution": { "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "de-DE", "notes": [ { "category": "legal_disclaimer", "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen." }, { "category": "description", "text": "IBM DB2 ist ein relationales Datenbanksystem (RDBS) von IBM.", "title": "Produktbeschreibung" }, { "category": "summary", "text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in IBM DB2 ausnutzen, um seine Privilegien zu erh\u00f6hen oder einen Denial of Service zu verursachen", "title": "Angriff" }, { "category": "general", "text": "- Linux\n- UNIX\n- Windows", "title": "Betroffene Betriebssysteme" } ], "publisher": { "category": "other", "contact_details": "csaf-provider@cert-bund.de", "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik", "namespace": "https://www.bsi.bund.de" }, "references": [ { "category": "self", "summary": "WID-SEC-W-2022-0770 - CSAF Version", "url": "https://wid.cert-bund.de/.well-known/csaf/white/2020/wid-sec-w-2022-0770.json" }, { "category": "self", "summary": "WID-SEC-2022-0770 - Portal Version", "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0770" }, { "category": "external", "summary": "IBM Security Bulletin 6198380 vom 2020-04-23", "url": "https://www.ibm.com/support/pages/node/6198380" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:2603 vom 2020-06-17", "url": "https://access.redhat.com/errata/RHSA-2020:2603" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2020:4807 vom 2020-11-04", "url": "https://access.redhat.com/errata/RHSA-2020:4807" }, { "category": "external", "summary": "Red Hat Security Advisory RHSA-2021:3225 vom 2021-08-20", "url": "https://access.redhat.com/errata/RHSA-2021:3225" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2022-115 vom 2022-05-27", "url": "https://www.hitachi.co.jp/Prod/comp/soft1/global/security/info/vuls/hitachi-sec-2022-115/index.html" }, { "category": "external", "summary": "IBM Security Bulletin 6605881 vom 2022-07-21", "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-security-vulnerabilities-have-been-identified-in-ibm-db2-shipped-with-ibm-puredata-system-for-operational-analytics/" }, { "category": "external", "summary": "Dell Security Advisory DSA-2024-070 vom 2024-02-03", "url": "https://www.dell.com/support/kbdoc/000221770/dsa-2024-=" }, { "category": "external", "summary": "Hitachi Vulnerability Information HITACHI-SEC-2023-144 vom 2023-10-03", "url": "https://www.hitachi.com/products/it/software/security/info/vuls/hitachi-sec-2023-144/index.html" }, { "category": "external", "summary": "IBM Security Bulletin 7153639 vom 2024-05-17", "url": "https://www.ibm.com/support/pages/node/7153639" } ], "source_lang": "en-US", "title": "IBM DB2: Mehrere Schwachstellen", "tracking": { "current_release_date": "2024-05-16T22:00:00.000+00:00", "generator": { "date": "2024-05-17T08:33:37.793+00:00", "engine": { "name": "BSI-WID", "version": "1.3.0" } }, "id": "WID-SEC-W-2022-0770", "initial_release_date": "2020-04-23T22:00:00.000+00:00", "revision_history": [ { "date": "2020-04-23T22:00:00.000+00:00", "number": "1", "summary": "Initiale Fassung" }, { "date": "2020-06-17T22:00:00.000+00:00", "number": "2", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2020-11-03T23:00:00.000+00:00", "number": "3", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2021-08-19T22:00:00.000+00:00", "number": "4", "summary": "Neue Updates von Red Hat aufgenommen" }, { "date": "2022-05-26T22:00:00.000+00:00", "number": "5", "summary": "Neue Updates von HITACHI aufgenommen" }, { "date": "2022-07-20T22:00:00.000+00:00", "number": "6", "summary": "Neue Updates von IBM aufgenommen" }, { "date": "2023-10-03T22:00:00.000+00:00", "number": "7", "summary": "Neue Updates von HITACHI aufgenommen" }, { "date": "2024-02-04T23:00:00.000+00:00", "number": "8", "summary": "Neue Updates von Dell aufgenommen" }, { "date": "2024-05-16T22:00:00.000+00:00", "number": "9", "summary": "Neue Updates von IBM aufgenommen" } ], "status": "final", "version": "9" } }, "product_tree": { "branches": [ { "branches": [ { "category": "product_name", "name": "EMC Avamar", "product": { "name": "EMC Avamar", "product_id": "T014381", "product_identification_helper": { "cpe": "cpe:/a:emc:avamar:-" } } } ], "category": "vendor", "name": "EMC" }, { "branches": [ { "branches": [ { "category": "product_name", "name": "Hitachi Ops Center", "product": { "name": "Hitachi Ops Center", "product_id": "T017562", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:-" } } }, { "category": "product_version_range", "name": "\u003cAnalyzer 10.9.3-00", "product": { "name": "Hitachi Ops Center \u003cAnalyzer 10.9.3-00", "product_id": "T030196", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:analyzer_10.9.3-00" } } }, { "category": "product_version_range", "name": "\u003cViewpoint 10.9.3-00", "product": { "name": "Hitachi Ops Center \u003cViewpoint 10.9.3-00", "product_id": "T030197", "product_identification_helper": { "cpe": "cpe:/a:hitachi:ops_center:viewpoint_10.9.3-00" } } } ], "category": "product_name", "name": "Ops Center" } ], "category": "vendor", "name": "Hitachi" }, { "branches": [ { "branches": [ { "category": "product_version", "name": "11.1", "product": { "name": "IBM DB2 11.1", "product_id": "342000", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:11.1" } } }, { "category": "product_version", "name": "11.5", "product": { "name": "IBM DB2 11.5", "product_id": "695419", "product_identification_helper": { "cpe": "cpe:/a:ibm:db2:11.5" } } } ], "category": "product_name", "name": "DB2" } ], "category": "vendor", "name": "IBM" }, { "branches": [ { "category": "product_name", "name": "Red Hat Enterprise Linux", "product": { "name": "Red Hat Enterprise Linux", "product_id": "67646", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:-" } } } ], "category": "vendor", "name": "Red Hat" } ] }, "vulnerabilities": [ { "cve": "CVE-2009-0001", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2009-0001" }, { "cve": "CVE-2014-0114", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2014-0114" }, { "cve": "CVE-2014-0193", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2014-0193" }, { "cve": "CVE-2014-3488", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2014-3488" }, { "cve": "CVE-2015-2156", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2015-2156" }, { "cve": "CVE-2016-2402", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2016-2402" }, { "cve": "CVE-2017-12972", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2017-12972" }, { "cve": "CVE-2017-12973", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2017-12973" }, { "cve": "CVE-2017-12974", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2017-12974" }, { "cve": "CVE-2017-18640", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2017-18640" }, { "cve": "CVE-2017-3734", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2017-3734" }, { "cve": "CVE-2017-5637", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2017-5637" }, { "cve": "CVE-2018-10237", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2018-10237" }, { "cve": "CVE-2018-11771", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2018-11771" }, { "cve": "CVE-2018-8009", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2018-8009" }, { "cve": "CVE-2018-8012", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2018-8012" }, { "cve": "CVE-2019-0201", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-0201" }, { "cve": "CVE-2019-10086", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-10086" }, { "cve": "CVE-2019-10172", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-10172" }, { "cve": "CVE-2019-10202", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-10202" }, { "cve": "CVE-2019-12402", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-12402" }, { "cve": "CVE-2019-16869", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-16869" }, { "cve": "CVE-2019-17195", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-17195" }, { "cve": "CVE-2019-17571", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-17571" }, { "cve": "CVE-2019-9512", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-9512" }, { "cve": "CVE-2019-9514", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-9514" }, { "cve": "CVE-2019-9515", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-9515" }, { "cve": "CVE-2019-9518", "notes": [ { "category": "description", "text": "In IBM DB2 existieren mehrere Schwachstellen in abh\u00e4ngigen Bibliotheken. Ein entfernter anonymer oder authentisierter Angreifer kann diese Schwachstellen ausnutzen, um einen Denial of Service zu verursachen oder seine Rechte zu erweitern." } ], "product_status": { "known_affected": [ "T014381", "342000", "67646", "695419", "T030196", "T017562", "T030197" ] }, "release_date": "2020-04-23T22:00:00Z", "title": "CVE-2019-9518" } ] }
var-201910-1730
Vulnerability from variot
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass. Connect2id Nimbus JOSE+JWT Contains an exceptional condition check vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Pillow is a Python-based image processing library. There is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Description:
The org.ovirt.engine-root is a core component of oVirt.
The following packages have been upgraded to a later upstream version: org.ovirt.engine-root (4.3.8.2), ovirt-engine-dwh (4.3.8), ovirt-engine-metrics (1.3.6.1), ovirt-fast-forward-upgrade (1.0.0), ovirt-imageio-common (1.5.3), ovirt-imageio-proxy (1.5.3), ovirt-web-ui (1.6.0), rhv-log-collector-analyzer (0.2.15), v2v-conversion-host (1.16.0).
Bug Fix(es):
-
[downstream clone - 4.4.0] Upgrade from 4.3 to 4.4 will fail if there are versioned templates in database (BZ#1688781)
-
[ovirt-fast-forward-upgrade] Error: ovirt-engine-setup-plugin-ovirt-engine conflicts with ovirt-engine-4.2.5.2-0.1.el7ev.noarch (BZ#1754979)
-
Users immediately logged out from User portal due to negative UserSessionTimeOutInterval (BZ#1757423)
-
Fluentd error when stopping metrics services through playbook on 4.3 (BZ#1772506)
-
[downstream clone - 4.3.8] From VM Portal, users cannot create Operating System Windows VM. (BZ#1780234)
Enhancement(s):
-
RFE for offline installation of RHV Metrics Store (BZ#1711873)
-
[RFE] Compare storage with database for discrepancies (BZ#1739106)
-
[RFE] RHV+Metrics Store - Support a Flat DNS environment without subdomains (BZ#1782412)
-
Bugs fixed (https://bugzilla.redhat.com/):
1752522 - ovirt-fast-forward-upgrade: Upgrade from 4.2 to 4.3 fails with UnicodeEncodeError 1764791 - CVE-2019-17195 nimbus-jose-jwt: Uncaught exceptions while parsing a JWT 1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default 1789737 - Import of OVA created from template fails with java.lang.NullPointerException [RHV clone - 4.3.9] 1792874 - Hide partial engine-cleanup option [RHV clone - 4.3.9] 1797496 - Add RHCOS os to osinfo - for compatability API between 4.3 to 4.4 1801310 - Module ovirt disk parameter storage domain has default option in documentation 1808038 - Unable to change Graphical Console of HE VM. [RHV clone - 4.3.9] 1808607 - RHVM 4.3.8.2 has Security Vulnerability Tenable Plugin ID 133165 in apache-commons-beanutils-1.8.3-14.el7 1809470 - [HE] ovirt-provider-ovn is non-functional on 4.3.9 Hosted-Engine [RHV clone - 4.3.9] 1810527 - Upgrade rhvm-dependencies to 4.3.2
- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256
===================================================================== Red Hat Security Advisory
Synopsis: Important: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update Advisory ID: RHSA-2020:3247-01 Product: Red Hat Virtualization Advisory URL: https://access.redhat.com/errata/RHSA-2020:3247 Issue date: 2020-08-04 CVE Names: CVE-2017-18635 CVE-2019-8331 CVE-2019-10086 CVE-2019-13990 CVE-2019-17195 CVE-2019-19336 CVE-2020-7598 CVE-2020-10775 CVE-2020-11022 CVE-2020-11023 =====================================================================
- Summary:
Updated ovirt-engine packages that fix several bugs and add various enhancements are now available.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
- Relevant releases/architectures:
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 - noarch, x86_64
- Description:
The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities, resource management, live migrations, and virtual infrastructure provisioning.
The Manager is a JBoss Application Server application that provides several interfaces through which the virtual environment can be accessed and interacted with, including an Administration Portal, a VM Portal, and a Representational State Transfer (REST) Application Programming Interface (API).
A list of bugs fixed in this update is available in the Technical Notes book:
https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/ht ml-single/technical_notes
Security Fix(es):
-
apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default (CVE-2019-10086)
-
libquartz: XXE attacks via job description (CVE-2019-13990)
-
novnc: XSS vulnerability via the messages propagated to the status field (CVE-2017-18635)
-
bootstrap: XSS in the tooltip or popover data-template attribute (CVE-2019-8331)
-
nimbus-jose-jwt: Uncaught exceptions while parsing a JWT (CVE-2019-17195)
-
ovirt-engine: response_type parameter allows reflected XSS (CVE-2019-19336)
-
nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload (CVE-2020-7598)
-
ovirt-engine: Redirect to arbitrary URL allows for phishing (CVE-2020-10775)
-
Cross-site scripting due to improper injQuery.htmlPrefilter method (CVE-2020-11022)
-
jQuery: passing HTML containing
For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.
- Solution:
Before applying this update, make sure all previously released errata relevant to your system have been applied.
For details on how to apply this update, refer to:
https://access.redhat.com/articles/2974891
- Bugs fixed (https://bugzilla.redhat.com/):
1080097 - [RFE] Allow editing disks details in the Disks tab 1325468 - [RFE] Autostart of VMs that are down (with Engine assistance - Engine has to be up) 1358501 - [RFE] multihost network change - notify when done 1427717 - [RFE] Create and/or select affinity group upon VM creation. 1475774 - RHV-M requesting four GetDeviceListVDSCommand when editing storage domain 1507438 - not able to deploy new rhvh host when "/tmp" is mounted with "noexec" option 1523835 - Hosted-Engine: memory hotplug does not work for engine vm 1527843 - [Tracker] Q35 chipset support (with seabios) 1529042 - [RFE] Changing of Cluster CPU Type does not trigger config update notification 1535796 - Undeployment of HE is not graceful 1546838 - [RFE] Refuse to deploy on localhost.localdomain 1547937 - [RFE] Live Storage Migration progress bar. 1585986 - [HE] When lowering the cluster compatibility, we need to force update the HE storage OVF store to ensure it can start up (migration will not work). 1593800 - [RFE] forbid new mac pools with overlapping ranges 1596178 - inconsistent display between automatic and manual Pool Type 1600059 - [RFE] Add by default a storage lease to HA VMs 1610212 - After updating to RHV 4.1 while trying to edit the disk, getting error "Cannot edit Virtual Disk. Cannot edit Virtual Disk. Disk extension combined with disk compat version update isn't supported. Please perform the updates separately." 1611395 - Unable to list Compute Templates in RHV 4.2 from Satellite 6.3.2 1616451 - [UI] add a tooltip to explain the supported matrix for the combination of disk allocation policies, formats and the combination result 1637172 - Live Merge hung in the volume deletion phase, leaving snapshot in a LOCKED state 1640908 - Javascript Error popup when Managing StorageDomain with LUNs and 400+ paths 1642273 - [UI] - left nav border highlight missing in RHV 1647440 - [RFE][UI] Provide information about the VM next run 1648345 - Jobs are not properly cleaned after a failed task. 1650417 - HA is broken for VMs having disks in NFS storage domain because of Qemu OFD locking 1650505 - Increase of ClusterCompatibilityVersion to Cluster with virtual machines with outstanding configuration changes, those changes will be reverted 1651406 - [RFE] Allow Maintenance of Host with Enforcing VM Affinity Rules (hard affinity) 1651939 - a new size of the direct LUN not updated in Admin Portal 1654069 - [Downstream Clone] [UI] - grids bottom scrollbar hides bottom row 1654889 - [RFE] Support console VNC for mediated devices 1656621 - Importing VM OVA always enables 'Cloud-Init/Sysprep' 1658101 - [RESTAPI] Adding ISO disables serial console 1659161 - Unable to edit pool that is delete protected 1660071 - Regression in Migration of VM that starts in pause mode: took 11 hours 1660644 - Concurrent LSMs of the same disk can be issued via the REST-API 1663366 - USB selection option disabled even though USB support is enabled in RHV-4.2 1664479 - Third VM fails to get migrated when host is placed into maintenance mode 1666913 - [UI] warn users about different "Vdsm Name" when creating network with a fancy char or long name 1670102 - [CinderLib] - openstack-cinder and cinderlib packages are not installed on ovirt-engine machine 1671876 - "Bond Active Slave" parameter on RHV-M GUI shows an incorrect until Refresh Caps 1679039 - Unable to upload image through Storage->Domain->Disk because of wrong DC 1679110 - [RFE] change Admin Portal toast notifications location 1679471 - [ja, de, es, fr, pt_BR] The console client resources page shows truncated title for some locales 1679730 - Warn about host IP addresses outside range 1686454 - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute 1686650 - Memory snapshots' deletion logging unnecessary WARNINGS in engine.log 1687345 - Snapshot with memory volumes can fail if the memory dump takes more than 180 seconds 1690026 - [RFE] - Creating an NFS storage domain the engine should let the user specify exact NFS version v4.0 and not just v4 1690155 - Disk migration progress bar not clearly visible and unusable. 1690475 - When a live storage migration fails, the auto generated snapshot does not get removed 1691562 - Cluster level changes are not increasing VMs generation numbers and so a new OVF_STORE content is not copied to the shared storage 1692592 - "Enable menu to select boot device shows 10 device listed with cdrom at 10th slot but when selecting 10 option the VM took 1 as option and boot with disk 1693628 - Engine generates too many updates to vm_dynamic table due to the session change 1693813 - Do not change DC level if there are VMs running/paused with older CL. 1695026 - Failure in creating snapshots during "Live Storage Migration" can result in a nonexistent snapshot 1695635 - [RFE] Improve Host Drop-down menu in different Dialogs (i.e. Alphabetical sort of Hosts in Remove|New StorageDomains) 1696245 - [RFE] Allow full customization while cloning a VM 1696669 - Build bouncycastle for RHV 4.4 RHEL 8 1696676 - Build ebay-cors-filter for RHV 4.4 RHEL 8 1698009 - Build openstack-java-sdk for RHV 4.4 RHEL 8 1698102 - Print a warning message to engine-setup, which highlights that other clusters than the Default one are not modified to use ovirt-provider-ovn as the default network provider 1700021 - [RFE] engine-setup should warn and prompt if ca.pem is missing but other generated pki files exist 1700036 - [RFE] Add RedFish API for host power management for RHEV 1700319 - VM is going to pause state with "storage I/O error". 1700338 - [RFE] Alternate method to configure the email Event Notifier for a user in RHV through API (instead of RHV GUI) 1700725 - [scale] RHV-M runs out of memory due to to much data reported by the guest agent 1700867 - Build makeself for RHV 4.4 RHEL 8 1701476 - Build unboundid-ldapsdk for RHV 4.4 RHEL 8 1701491 - Build RHV-M 4.4 - RHEL 8 1701522 - Build ovirt-imageio-proxy for RHV 4.4 / RHEL 8 1701528 - Build / Tag python-ovsdbapp for RHV 4.4 RHEL 8 1701530 - Build / Tag ovirt-cockpit-sso for RHV 4.4 RHEL 8 1701531 - Build / Tag ovirt-engine-api-explorer for RHV 4.4 RHEL 8 1701533 - Build / Tag ovirt-engine-dwh for RHV 4.4 / RHEL 8 1701538 - Build / Tag vdsm-jsonrpc-java for RHV 4.4 RHEL 8 1701544 - Build rhvm-dependencies for RHV 4.4 RHEL 8 1702310 - Build / Tag ovirt-engine-ui-extensions for RHV 4.4 RHEL 8 1702312 - Build ovirt-log-collector for RHV 4.4 RHEL 8 1703112 - PCI address of NICs are not stored in the database after a hotplug of passthrough NIC resulting in change of network device name in VM after a reboot 1703428 - VMs migrated from KVM to RHV show warning 'The latest guest agent needs to be installed and running on the guest' 1707225 - [cinderlib] Cinderlib DB is missing a backup and restore option 1708624 - Build rhvm-setup-plugins for RHV 4.4 - RHEL 8 1710491 - No EVENT_ID is generated in /var/log/ovirt-engine/engine.log when VM is rebooted from OS level itself. 1711006 - Metrics installation fails during the execution of playbook ovirt-metrics-store-installation if the environment is not having DHCP 1712255 - Drop 4.1 datacenter/cluster level 1712746 - [RFE] Ignition support for ovirt vms 1712890 - engine-setup should check for snapshots in unsupported CL 1714528 - Missing IDs on cluster upgrade buttons 1714633 - Using more than one asterisk in the search string is not working when searching for users. 1714834 - Cannot disable SCSI passthrough using API 1715725 - Sending credentials in query string logs them in ovirt-request-logs 1716590 - [RFE][UX] Make Cluster-wide "Custom serial number policy" value visible at VM level 1718818 - [RFE] Enhance local disk passthrough 1720686 - Tag ovirt-scheduler-proxy for RHV 4.4 RHEL 8 1720694 - Build ovirt-engine-extension-aaa-jdbc for RHV 4.4 RHEL 8 1720795 - New guest tools are available mark in case of guest tool located on Data Domain 1724959 - RHV recommends reporting issues to GitHub rather than access.redhat.com (ovirt->RHV rebrand glitch?) 1727025 - NPE in DestroyImage endAction during live merge leaving a task in DB for hours causing operations depending on host clean tasks to fail as Deactivate host/StopSPM/deactivate SD 1728472 - Engine reports network out of sync due to ipv6 default gateway via ND RA on a non default route network. 1729511 - engine-setup fails to upgrade to 4.3 with Unicode characters in CA subject 1729811 - [scale] updatevmdynamic broken if too many users logged in - psql ERROR: value too long for type character varying(255) 1730264 - VMs will fail to start if the vnic profile attached is having port mirroring enabled and have name greater than 15 characters 1730436 - Snapshot creation was successful, but snapshot remains locked 1731212 - RHV 4.4 landing page does not show login or allow scrolling. 1731590 - Cannot preview snapshot, it fails and VM remains locked. 1733031 - [RFE] Add warning when importing data domains to newer DC that may trigger SD format upgrade 1733529 - Consume python-ovsdbapp dependencies from OSP in RHEL 8 RHV 4.4 1733843 - Export to OVA fails if VM is running on the Host doing the export 1734839 - Unable to start guests in our Power9 cluster without running in headless mode. 1737234 - Attach a non-existent ISO to vm by the API return 201 and marks the Attach CD checkbox as ON 1737684 - Engine deletes the leaf volume when SnapshotVDSCommand timed out without checking if the volume is still used by the VM 1740978 - [RFE] Warn or Block importing VMs/Templates from unsupported compatibility levels. 1741102 - host activation causes RHHI nodes to lose the quorum 1741271 - Move/Copy disk are blocked if there is less space in source SD than the size of the disk 1741625 - VM fails to be re-started with error: Failed to acquire lock: No space left on device 1743690 - Commit and Undo buttons active when no snapshot selected 1744557 - RHV 4.3 throws an exception when trying to access VMs which have snapshots from unsupported compatibility levels 1745384 - [IPv6 Static] Engine should allow updating network's static ipv6gateway 1745504 - Tag rhv-log-collector-analyzer for RHV 4.4 RHEL 8 1746272 - [BREW BUILD ENABLER] Build the oVirt Ansible roles for RHV 4.4.0 1746430 - [Rebase] Rebase v2v-conversion-host for RHV 4.4 Engine 1746877 - [Metrics] Rebase bug - for the 4.4 release on EL8 1747772 - Extra white space at the top of webadmin dialogs 1749284 - Change the Snapshot operation to be asynchronous 1749944 - teardownImage attempts to deactivate in-use LV's rendering the VM disk image/volumes in locked state. 1750212 - MERGE_STATUS fails with 'Invalid UUID string: mapper' when Direct LUN that already exists is hot-plugged 1750348 - [Tracking] rhvm-branding-rhv for RHV 4.4 1750357 - [Tracking] ovirt-web-ui for RHV 4.4 1750371 - [Tracking] ovirt-engine-ui-extensions for RHV 4.4 1750482 - From VM Portal, users cannot create Operating System Windows VM. 1751215 - Unable to change Graphical Console of HE VM. 1751268 - add links to Insights to landing page 1751423 - Improve description of shared memory statistics and remove unimplemented memory metrics from API 1752890 - Build / Tag ovirt-engine-extension-aaa-ldap for RHV 4.4 RHEL 8 1752995 - [RFE] Need to be able to set default console option 1753629 - Build / Tag ovirt-engine-extension-aaa-misc for RHV 4.4 RHEL 8 1753661 - Build / Tag ovirt-engine-extension-logger-log4j got RHV 4.4 / RHEl 8 1753664 - Build ovirt-fast-forward-upgrade for RHV 4.4 /RHEL 8 support 1754363 - [Scale] Engine generates excessive amount of dns configuration related sql queries 1754490 - RHV Manager cannot start on EAP 7.2.4 1755412 - Setting "oreg_url: registry.redhat.io" fails with error 1758048 - clone(as thin) VM from template or create snapshot fails with 'Requested capacity 1073741824 < parent capacity 3221225472 (volume:1211)' 1758289 - [Warn] Duplicate chassis entries in southbound database if the host is down while removing the host from Manager 1762281 - Import of OVA created from template fails with java.lang.NullPointerException 1763992 - [RFE] Show "Open Console" as the main option in the VM actions menu 1764289 - Document details how each fence agent can be configured in RESTAPI 1764791 - CVE-2019-17195 nimbus-jose-jwt: Uncaught exceptions while parsing a JWT 1764932 - [BREW BUILD ENABLER] Build the ansible-runner-service for RHV 4.4 1764943 - Create Snapshot does not proceed beyond CreateVolume 1764959 - Apache is configured to offer TRACE method (security) 1765660 - CVE-2017-18635 novnc: XSS vulnerability via the messages propagated to the status field 1767319 - [RFE] forbid updating mac pool that contains ranges overlapping with any mac range in the system 1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default 1768707 - Cannot set or update iscsi portal group tag when editing storage connection via API 1768844 - RHEL Advanced virtualization module streams support 1769463 - [Scale] Slow performance for api/clusters when many networks devices are present 1770237 - Cannot assign a vNIC profile for VM instance profile. 1771793 - VM Portal crashes in what appears to be a permission related problem. 1773313 - RHV Metric store installation fails with error: "You need to install \"jmespath\" prior to running json_query filter" 1777954 - VM Templates greater then 101 quantity are not listed/reported in RHV-M Webadmin UI. 1779580 - drop rhvm-doc package 1781001 - CVE-2019-19336 ovirt-engine: response_type parameter allows reflected XSS 1782236 - Windows Update (the drivers) enablement 1782279 - Warning message for low space is not received on Imported Storage domain 1782882 - qemu-kvm: kvm_init_vcpu failed: Function not implemented 1784049 - Rhel6 guest with cluster default q35 chipset causes kernel panic 1784385 - Still requiring rhvm-doc in rhvm-setup-plugins 1785750 - [RFE] Ability to change default VM action (Suspend) in the VM Portal. 1788424 - Importing a VM having direct LUN attached using virtio driver is failing with error "VirtIO-SCSI is disabled for the VM" 1796809 - Build apache-sshd for RHV 4.4 RHEL 8 1796811 - Remove bundled apache-sshd library 1796815 - Build snmp4j for RHV 4.4 RHEL 8 1796817 - Remove bundled snmp4j library 1797316 - Snapshot creation from VM fails on second snapshot and afterwords 1797500 - Add disk operation failed to complete. 1798114 - Build apache-commons-digester for RHV 4.4 RHEL 8 1798117 - Build apache-commons-configuration for RHV 4.4 RHEL 8 1798120 - Build apache-commons-jexl for RHV 4.4 RHEL 8 1798127 - Build apache-commons-collections4 for RHV 4.4 RHEL 8 1798137 - Build apache-commons-vfs for RHV 4.4 RHEL 8 1799171 - Build ws-commons-util for RHV 4.4 RHEL 8 1799204 - Build xmlrpc for RHV 4.4 RHEL 8 1801149 - CVE-2019-13990 libquartz: XXE attacks via job description 1801709 - Disable activation of the host while Enroll certificate flow is still in progress 1803597 - rhv-image-discrepancies should skip storage domains in maintenance mode and ISO/Export 1805669 - change requirement on rhvm package from spice-client-msi to spice-client-win 1806276 - [HE] ovirt-provider-ovn is non-functional on 4.3.9 Hosted-Engine 1807047 - Build m2crypto for RHV 4.4 RHEL 8 1807860 - [RFE] Allow resource allocation options to be customized 1808096 - Uploading ISOs causes "Uncaught exception occurred. Please try reloading the page. Details: (TypeError) : a.n is null" 1808126 - host_service.install() does not work with deploy_hosted_engine as True. 1809040 - [CNV&RHV] let the user know that token is not valid anymore 1809052 - [CNV&RHV] ovirt-engine log file spammed by failed timers ( approx 3-5 messages/sec ) 1809875 - rhv-image-discrepancies only compares images on the last DC 1809877 - rhv-image-discrepancies sends dump-volume-chains with parameter that is ignored 1810893 - mountOptions is ignored for "import storage domain" from GUI 1811865 - [Scale] Host Monitoring generates excessive amount of qos related sql queries 1811869 - [Scale] Webadmin\REST for host interface list response time is too long because of excessive amount of qos related sql queries 1812875 - Unable to create VMs when french Language is selected for the rhvm gui. 1813305 - Engine updating SLA policies of VMs continuously in an environment which is not having any QOS configured 1813344 - CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload 1814197 - [CNV&RHV] when provider is remover DC is left behind and active 1814215 - [CNV&RHV] Adding new provider to engine fails after succesfull test 1816017 - Build log4j12 for RHV 4.4 EL8 1816643 - [CNV&RHV] VM created in CNV not visible in RHV 1816654 - [CNV&RHV] adding provider with already created vm failed 1816693 - [CNV&RHV] CNV VM failed to restart even if 1st dialog looks fine 1816739 - [CNV&RHV] CNV VM updated form CNV side doesn't update vm properties over on RHV side 1817467 - [Tracking] Migration path between RHV 4.3 and 4.4 1818745 - rhv-log-collector-analyzer 0.2.17 still requires pyhton2 1819201 - [CodeChange][i18n] oVirt 4.4 rhv branding - translation update 1819248 - Cannot upgrade host after engine setup 1819514 - Failed to register 4.4 host to the latest engine (4.4.0-0.29.master.el8ev) 1819960 - NPE on ImportVmTemplateFromConfigurationCommand when creating VM from ovf_data 1820621 - Build apache-commons-compress for RHV 4.4 EL8 1820638 - Build apache-commons-jxpath for RHV 4.4 EL8 1821164 - Failed snapshot creation can cause data corruption of other VMs 1821930 - Enable only TLSv1.2+ protocol for SPICE on EL7 hosts 1824095 - VM portal shows only error 1825793 - RHV branding is missing after upgrade from 4.3 1826248 - [4.4][ovirt-cockpit-sso] Compatibility issues with python3 1826437 - The console client resources page return HTTP code 500 1826801 - [CNV&RHV] update of memory on cnv side does not propagate to rhv 1826855 - [cnv&rhv] update of cpu on cnv side causing expetion in engine.log 1828406 - CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method 1828669 - After SPM select the engine lost communication to all hosts until restarted [improved logging] 1828736 - [CNV&RHV] cnv template is not propagated to rhv 1829189 - engine-setup httpd ssl configuration conflicts with Red Hat Insights 1829656 - Failed to register 4.3 host to 4.4 engine with 4.3 cluster (4.4.0-0.33.master.el8ev) 1829830 - vhost custom properties does not accept '-' 1832161 - rhv-log-collector-analyzer fails with UnicodeDecodeError on RHEL8 1834523 - Edit VM -> Enable Smartcard sharing does not stick when VM is running 1838493 - Live snapshot made with freeze in the engine will cause the FS to be frozen 1841495 - Upgrade openstack-java-sdk to 3.2.9 1842495 - high cpu usage after entering wrong search pattern in RHVM 1844270 - [vGPU] nodisplay option for mdev broken since mdev scheduling unit 1844855 - Missing images (favicon.ico, banner logo) and missing brand.css file on VM portal d/s installation 1845473 - Exporting an OVA file from a VM results in its ovf file having a format of RAW when the disk is COW 1847420 - CVE-2020-10775 ovirt-engine: Redirect to arbitrary URL allows for phishing 1850004 - CVE-2020-11023 jQuery: passing HTML containing
- Package List:
RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4:
Source: ansible-runner-1.4.5-1.el8ar.src.rpm ansible-runner-service-1.0.2-1.el8ev.src.rpm apache-commons-collections4-4.4-1.el8ev.src.rpm apache-commons-compress-1.18-1.el8ev.src.rpm apache-commons-configuration-1.10-1.el8ev.src.rpm apache-commons-jexl-2.1.1-1.el8ev.src.rpm apache-commons-jxpath-1.3-29.el8ev.src.rpm apache-commons-vfs-2.4.1-1.el8ev.src.rpm apache-sshd-2.5.1-1.el8ev.src.rpm ebay-cors-filter-1.0.1-4.el8ev.src.rpm ed25519-java-0.3.0-1.el8ev.src.rpm engine-db-query-1.6.1-1.el8ev.src.rpm java-client-kubevirt-0.5.0-1.el8ev.src.rpm log4j12-1.2.17-22.el8ev.src.rpm m2crypto-0.35.2-5.el8ev.src.rpm makeself-2.4.0-4.el8ev.src.rpm novnc-1.1.0-1.el8ost.src.rpm openstack-java-sdk-3.2.9-1.el8ev.src.rpm ovirt-cockpit-sso-0.1.4-1.el8ev.src.rpm ovirt-engine-4.4.1.8-0.7.el8ev.src.rpm ovirt-engine-api-explorer-0.0.6-1.el8ev.src.rpm ovirt-engine-dwh-4.4.1.2-1.el8ev.src.rpm ovirt-engine-extension-aaa-jdbc-1.2.0-1.el8ev.src.rpm ovirt-engine-extension-aaa-ldap-1.4.0-1.el8ev.src.rpm ovirt-engine-extension-aaa-misc-1.1.0-1.el8ev.src.rpm ovirt-engine-extension-logger-log4j-1.1.0-1.el8ev.src.rpm ovirt-engine-extensions-api-1.0.1-1.el8ev.src.rpm ovirt-engine-metrics-1.4.1.1-1.el8ev.src.rpm ovirt-engine-ui-extensions-1.2.2-1.el8ev.src.rpm ovirt-fast-forward-upgrade-1.1.6-0.el8ev.src.rpm ovirt-log-collector-4.4.2-1.el8ev.src.rpm ovirt-scheduler-proxy-0.1.9-1.el8ev.src.rpm ovirt-web-ui-1.6.3-1.el8ev.src.rpm python-aniso8601-0.82-4.el8ost.src.rpm python-flask-1.0.2-2.el8ost.src.rpm python-flask-restful-0.3.6-8.el8ost.src.rpm python-netaddr-0.7.19-8.1.el8ost.src.rpm python-notario-0.0.16-2.el8cp.src.rpm python-ovsdbapp-0.17.1-0.20191216120142.206cf14.el8ost.src.rpm python-pbr-5.1.2-2.el8ost.src.rpm python-six-1.12.0-1.el8ost.src.rpm python-websocket-client-0.54.0-1.el8ost.src.rpm python-werkzeug-0.16.0-1.el8ost.src.rpm rhv-log-collector-analyzer-1.0.2-1.el8ev.src.rpm rhvm-branding-rhv-4.4.4-1.el8ev.src.rpm rhvm-dependencies-4.4.0-1.el8ev.src.rpm rhvm-setup-plugins-4.4.2-1.el8ev.src.rpm snmp4j-2.4.1-1.el8ev.src.rpm unboundid-ldapsdk-4.0.14-1.el8ev.src.rpm vdsm-jsonrpc-java-1.5.4-1.el8ev.src.rpm ws-commons-util-1.0.2-1.el8ev.src.rpm xmlrpc-3.1.3-1.el8ev.src.rpm
noarch: ansible-runner-1.4.5-1.el8ar.noarch.rpm ansible-runner-service-1.0.2-1.el8ev.noarch.rpm apache-commons-collections4-4.4-1.el8ev.noarch.rpm apache-commons-collections4-javadoc-4.4-1.el8ev.noarch.rpm apache-commons-compress-1.18-1.el8ev.noarch.rpm apache-commons-compress-javadoc-1.18-1.el8ev.noarch.rpm apache-commons-configuration-1.10-1.el8ev.noarch.rpm apache-commons-jexl-2.1.1-1.el8ev.noarch.rpm apache-commons-jexl-javadoc-2.1.1-1.el8ev.noarch.rpm apache-commons-jxpath-1.3-29.el8ev.noarch.rpm apache-commons-jxpath-javadoc-1.3-29.el8ev.noarch.rpm apache-commons-vfs-2.4.1-1.el8ev.noarch.rpm apache-commons-vfs-ant-2.4.1-1.el8ev.noarch.rpm apache-commons-vfs-examples-2.4.1-1.el8ev.noarch.rpm apache-commons-vfs-javadoc-2.4.1-1.el8ev.noarch.rpm apache-sshd-2.5.1-1.el8ev.noarch.rpm apache-sshd-javadoc-2.5.1-1.el8ev.noarch.rpm ebay-cors-filter-1.0.1-4.el8ev.noarch.rpm ed25519-java-0.3.0-1.el8ev.noarch.rpm ed25519-java-javadoc-0.3.0-1.el8ev.noarch.rpm engine-db-query-1.6.1-1.el8ev.noarch.rpm java-client-kubevirt-0.5.0-1.el8ev.noarch.rpm log4j12-1.2.17-22.el8ev.noarch.rpm log4j12-javadoc-1.2.17-22.el8ev.noarch.rpm makeself-2.4.0-4.el8ev.noarch.rpm novnc-1.1.0-1.el8ost.noarch.rpm openstack-java-ceilometer-client-3.2.9-1.el8ev.noarch.rpm openstack-java-ceilometer-model-3.2.9-1.el8ev.noarch.rpm openstack-java-cinder-client-3.2.9-1.el8ev.noarch.rpm openstack-java-cinder-model-3.2.9-1.el8ev.noarch.rpm openstack-java-client-3.2.9-1.el8ev.noarch.rpm openstack-java-glance-client-3.2.9-1.el8ev.noarch.rpm openstack-java-glance-model-3.2.9-1.el8ev.noarch.rpm openstack-java-heat-client-3.2.9-1.el8ev.noarch.rpm openstack-java-heat-model-3.2.9-1.el8ev.noarch.rpm openstack-java-javadoc-3.2.9-1.el8ev.noarch.rpm openstack-java-keystone-client-3.2.9-1.el8ev.noarch.rpm openstack-java-keystone-model-3.2.9-1.el8ev.noarch.rpm openstack-java-nova-client-3.2.9-1.el8ev.noarch.rpm openstack-java-nova-model-3.2.9-1.el8ev.noarch.rpm openstack-java-quantum-client-3.2.9-1.el8ev.noarch.rpm openstack-java-quantum-model-3.2.9-1.el8ev.noarch.rpm openstack-java-resteasy-connector-3.2.9-1.el8ev.noarch.rpm openstack-java-swift-client-3.2.9-1.el8ev.noarch.rpm openstack-java-swift-model-3.2.9-1.el8ev.noarch.rpm ovirt-cockpit-sso-0.1.4-1.el8ev.noarch.rpm ovirt-engine-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-api-explorer-0.0.6-1.el8ev.noarch.rpm ovirt-engine-backend-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-dbscripts-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-dwh-4.4.1.2-1.el8ev.noarch.rpm ovirt-engine-dwh-grafana-integration-setup-4.4.1.2-1.el8ev.noarch.rpm ovirt-engine-dwh-setup-4.4.1.2-1.el8ev.noarch.rpm ovirt-engine-extension-aaa-jdbc-1.2.0-1.el8ev.noarch.rpm ovirt-engine-extension-aaa-ldap-1.4.0-1.el8ev.noarch.rpm ovirt-engine-extension-aaa-ldap-setup-1.4.0-1.el8ev.noarch.rpm ovirt-engine-extension-aaa-misc-1.1.0-1.el8ev.noarch.rpm ovirt-engine-extension-logger-log4j-1.1.0-1.el8ev.noarch.rpm ovirt-engine-extensions-api-1.0.1-1.el8ev.noarch.rpm ovirt-engine-extensions-api-javadoc-1.0.1-1.el8ev.noarch.rpm ovirt-engine-health-check-bundler-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-metrics-1.4.1.1-1.el8ev.noarch.rpm ovirt-engine-restapi-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-setup-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-setup-base-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-setup-plugin-cinderlib-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-setup-plugin-imageio-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-setup-plugin-ovirt-engine-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-setup-plugin-ovirt-engine-common-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-setup-plugin-vmconsole-proxy-helper-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-setup-plugin-websocket-proxy-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-tools-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-tools-backup-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-ui-extensions-1.2.2-1.el8ev.noarch.rpm ovirt-engine-vmconsole-proxy-helper-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-webadmin-portal-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-engine-websocket-proxy-4.4.1.8-0.7.el8ev.noarch.rpm ovirt-fast-forward-upgrade-1.1.6-0.el8ev.noarch.rpm ovirt-log-collector-4.4.2-1.el8ev.noarch.rpm ovirt-scheduler-proxy-0.1.9-1.el8ev.noarch.rpm ovirt-web-ui-1.6.3-1.el8ev.noarch.rpm python-flask-doc-1.0.2-2.el8ost.noarch.rpm python2-netaddr-0.7.19-8.1.el8ost.noarch.rpm python2-pbr-5.1.2-2.el8ost.noarch.rpm python2-six-1.12.0-1.el8ost.noarch.rpm python3-aniso8601-0.82-4.el8ost.noarch.rpm python3-ansible-runner-1.4.5-1.el8ar.noarch.rpm python3-flask-1.0.2-2.el8ost.noarch.rpm python3-flask-restful-0.3.6-8.el8ost.noarch.rpm python3-netaddr-0.7.19-8.1.el8ost.noarch.rpm python3-notario-0.0.16-2.el8cp.noarch.rpm python3-ovirt-engine-lib-4.4.1.8-0.7.el8ev.noarch.rpm python3-ovsdbapp-0.17.1-0.20191216120142.206cf14.el8ost.noarch.rpm python3-pbr-5.1.2-2.el8ost.noarch.rpm python3-six-1.12.0-1.el8ost.noarch.rpm python3-websocket-client-0.54.0-1.el8ost.noarch.rpm python3-werkzeug-0.16.0-1.el8ost.noarch.rpm python3-werkzeug-doc-0.16.0-1.el8ost.noarch.rpm rhv-log-collector-analyzer-1.0.2-1.el8ev.noarch.rpm rhvm-4.4.1.8-0.7.el8ev.noarch.rpm rhvm-branding-rhv-4.4.4-1.el8ev.noarch.rpm rhvm-dependencies-4.4.0-1.el8ev.noarch.rpm rhvm-setup-plugins-4.4.2-1.el8ev.noarch.rpm snmp4j-2.4.1-1.el8ev.noarch.rpm snmp4j-javadoc-2.4.1-1.el8ev.noarch.rpm unboundid-ldapsdk-4.0.14-1.el8ev.noarch.rpm unboundid-ldapsdk-javadoc-4.0.14-1.el8ev.noarch.rpm vdsm-jsonrpc-java-1.5.4-1.el8ev.noarch.rpm ws-commons-util-1.0.2-1.el8ev.noarch.rpm ws-commons-util-javadoc-1.0.2-1.el8ev.noarch.rpm xmlrpc-client-3.1.3-1.el8ev.noarch.rpm xmlrpc-common-3.1.3-1.el8ev.noarch.rpm xmlrpc-javadoc-3.1.3-1.el8ev.noarch.rpm xmlrpc-server-3.1.3-1.el8ev.noarch.rpm
x86_64: m2crypto-debugsource-0.35.2-5.el8ev.x86_64.rpm python3-m2crypto-0.35.2-5.el8ev.x86_64.rpm python3-m2crypto-debuginfo-0.35.2-5.el8ev.x86_64.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/
- References:
https://access.redhat.com/security/cve/CVE-2017-18635 https://access.redhat.com/security/cve/CVE-2019-8331 https://access.redhat.com/security/cve/CVE-2019-10086 https://access.redhat.com/security/cve/CVE-2019-13990 https://access.redhat.com/security/cve/CVE-2019-17195 https://access.redhat.com/security/cve/CVE-2019-19336 https://access.redhat.com/security/cve/CVE-2020-7598 https://access.redhat.com/security/cve/CVE-2020-10775 https://access.redhat.com/security/cve/CVE-2020-11022 https://access.redhat.com/security/cve/CVE-2020-11023 https://access.redhat.com/security/updates/classification/#important https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html-single/technical_notes
- Contact:
The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/
Copyright 2020 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1
iQIVAwUBXylir9zjgjWX9erEAQii/A//bJm3u0+ul+LdQwttSJJ79OdVqcp3FktP tdPj8AFbB6F9KkuX9FAQja0/2pgZAldB3Eyz57GYTxyDD1qeMqYSayGHCH01GWAn u8uF90lcSz6YvgEPDh1mWhLYQMfdWT6IUuKOEHldt8TyHbc7dX3xCbsLDzNCxGbl QuPSFPQBJaAXETSw42NGzdUzaM9zoQ0Mngj+Owcgw53YyBy3BSLAb5bKuijvkcLy SVCAxxiQ89E+cnETKYIv4dOfqXGA5wLg68hDmUQyFcXHA9nQbJM9Q0s1fbZ2Wav1 oGGTqJDTgVElxrHB5pYJ6pu484ZgJealkBCrHA2OBsMJUadwitVvQLXFZF5OyN0N f/vtZ1ua4mZADa61qfnlmVRiyISwmPPWIOImA3TIE5Q8Yl5ucCqtDjQPoJAbXsUl Y22Bb5x7JyrN0nyOgwh6BGGK51CmOaP+xNuWD7osI24pnzdmPTZuJrZLePxgPgac WWQNznzvokknva2ofvujAm+DEl+W7W3A8Vs9wkmUWYlaVC7GFLEkcvQjjHahZ7kh dVJNoh70vpA+aJCMQHYK6MGtCSAWoqXkRTsHb3Stfm2vLLz6GYxY5OuvB7Z0ME1N zCiFjBla5+3nKx5ab8Pola56T1wRULHL6zYN9GTsOzxjdJsKHXBVeV8OYcnoHiza 2TrKn2dtZwI= =92Q3 -----END PGP SIGNATURE-----
-- RHSA-announce mailing list RHSA-announce@redhat.com https://www.redhat.com/mailman/listinfo/rhsa-announce
Show details on source website{ "@context": { "@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#", "affected_products": { "@id": "https://www.variotdbs.pl/ref/affected_products" }, "configurations": { "@id": "https://www.variotdbs.pl/ref/configurations" }, "credits": { "@id": "https://www.variotdbs.pl/ref/credits" }, "cvss": { "@id": "https://www.variotdbs.pl/ref/cvss/" }, "description": { "@id": "https://www.variotdbs.pl/ref/description/" }, "exploit_availability": { "@id": "https://www.variotdbs.pl/ref/exploit_availability/" }, "external_ids": { "@id": "https://www.variotdbs.pl/ref/external_ids/" }, "iot": { "@id": "https://www.variotdbs.pl/ref/iot/" }, "iot_taxonomy": { "@id": "https://www.variotdbs.pl/ref/iot_taxonomy/" }, "patch": { "@id": "https://www.variotdbs.pl/ref/patch/" }, "problemtype_data": { "@id": "https://www.variotdbs.pl/ref/problemtype_data/" }, "references": { "@id": "https://www.variotdbs.pl/ref/references/" }, "sources": { "@id": "https://www.variotdbs.pl/ref/sources/" }, "sources_release_date": { "@id": "https://www.variotdbs.pl/ref/sources_release_date/" }, "sources_update_date": { "@id": "https://www.variotdbs.pl/ref/sources_update_date/" }, "threat_type": { "@id": "https://www.variotdbs.pl/ref/threat_type/" }, "title": { "@id": "https://www.variotdbs.pl/ref/title/" }, "type": { "@id": "https://www.variotdbs.pl/ref/type/" } }, "@id": "https://www.variotdbs.pl/vuln/VAR-201910-1730", "affected_products": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/affected_products#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "model": "healthcare data repository", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "8.1.0" }, { "model": "insurance policy administration", "scope": "gte", "trust": 1.0, "vendor": "oracle", "version": "11.0" }, { "model": "policy automation", "scope": "lte", "trust": 1.0, "vendor": "oracle", "version": "12.2.22" }, { "model": "primavera gateway", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "19.12.0" }, { "model": "jd edwards enterpriseone orchestrator", "scope": "lte", "trust": 1.0, "vendor": "oracle", "version": "9.2.5.3" }, { "model": "peoplesoft enterprise peopletools", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "8.59" }, { "model": "weblogic server", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "12.2.1.3.0" }, { "model": "solaris cluster", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "4.0" }, { "model": "jd edwards enterpriseone tools", "scope": "lte", "trust": 1.0, "vendor": "oracle", "version": "9.2.5.3" }, { "model": "nimbus jose\\+jwt", "scope": "lt", "trust": 1.0, "vendor": "connect2id", "version": "7.9" }, { "model": "hadoop", "scope": "eq", "trust": 1.0, "vendor": "apache", "version": "3.2.1" }, { "model": "policy automation", "scope": "gte", "trust": 1.0, "vendor": "oracle", "version": "12.2.0" }, { "model": "weblogic server", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "12.2.1.4.0" }, { "model": "communications cloud native core security edge protection proxy", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "1.7.0" }, { "model": "data integrator", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "12.2.1.4.0" }, { "model": "communications pricing design center", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "12.0.0.3.0" }, { "model": "primavera gateway", "scope": "lte", "trust": 1.0, "vendor": "oracle", "version": "18.8.11" }, { "model": "primavera gateway", "scope": "gte", "trust": 1.0, "vendor": "oracle", "version": "18.8.0" }, { "model": "enterprise manager base platform", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "13.4.0.0" }, { "model": "insurance policy administration", "scope": "lte", "trust": 1.0, "vendor": "oracle", "version": "11.3.1" }, { "model": "peoplesoft enterprise peopletools", "scope": "eq", "trust": 1.0, "vendor": "oracle", "version": "8.58" }, { "model": "nimbus jose+jwt", "scope": "lt", "trust": 0.8, "vendor": "connect2id", "version": "7.9" } ], "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-010680" }, { "db": "NVD", "id": "CVE-2019-17195" } ] }, "configurations": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/configurations#", "children": { "@container": "@list" }, "cpe_match": { "@container": "@list" }, "data": { "@container": "@list" }, "nodes": { "@container": "@list" } }, "data": [ { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:connect2id:nimbus_jose\\+jwt:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndExcluding": "7.9", "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:apache:hadoop:3.2.1:-:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:oracle:solaris_cluster:4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:enterprise_manager_base_platform:13.4.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:19.12.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:data_integrator:12.2.1.4.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "18.8.11", "versionStartIncluding": "18.8.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "9.2.5.3", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "12.2.22", "versionStartIncluding": "12.2.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.7.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:insurance_policy_administration:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "11.3.1", "versionStartIncluding": "11.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:healthcare_data_repository:8.1.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "9.2.5.3", "vulnerable": true } ], "operator": "OR" } ] } ], "sources": [ { "db": "NVD", "id": "CVE-2019-17195" } ] }, "credits": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/credits#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Red Hat", "sources": [ { "db": "PACKETSTORM", "id": "157073" }, { "db": "PACKETSTORM", "id": "158750" }, { "db": "CNNVD", "id": "CNNVD-201910-914" } ], "trust": 0.8 }, "cve": "CVE-2019-17195", "cvss": { "@context": { "cvssV2": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV2" }, "cvssV3": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#" }, "@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/" }, "severity": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/cvss/severity#" }, "@id": "https://www.variotdbs.pl/ref/cvss/severity" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" }, "@id": "https://www.variotdbs.pl/ref/sources" } }, "data": [ { "cvssV2": [ { "acInsufInfo": false, "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "NVD", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "impactScore": 6.4, "integrityImpact": "PARTIAL", "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "trust": 1.0, "userInteractionRequired": false, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "acInsufInfo": null, "accessComplexity": "Medium", "accessVector": "Network", "authentication": "None", "author": "NVD", "availabilityImpact": "Partial", "baseScore": 6.8, "confidentialityImpact": "Partial", "exploitabilityScore": null, "id": "CVE-2019-17195", "impactScore": null, "integrityImpact": "Partial", "obtainAllPrivilege": null, "obtainOtherPrivilege": null, "obtainUserPrivilege": null, "severity": "Medium", "trust": 0.9, "userInteractionRequired": null, "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0" }, { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "author": "VULHUB", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "exploitabilityScore": 8.6, "id": "VHN-149417", "impactScore": 6.4, "integrityImpact": "PARTIAL", "severity": "MEDIUM", "trust": 0.1, "vectorString": "AV:N/AC:M/AU:N/C:P/I:P/A:P", "version": "2.0" } ], "cvssV3": [ { "attackComplexity": "LOW", "attackVector": "NETWORK", "author": "NVD", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "exploitabilityScore": 3.9, "impactScore": 5.9, "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "trust": 1.0, "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, { "attackComplexity": "Low", "attackVector": "Network", "author": "NVD", "availabilityImpact": "High", "baseScore": 9.8, "baseSeverity": "Critical", "confidentialityImpact": "High", "exploitabilityScore": null, "id": "CVE-2019-17195", "impactScore": null, "integrityImpact": "High", "privilegesRequired": "None", "scope": "Unchanged", "trust": 0.8, "userInteraction": "None", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.0" } ], "severity": [ { "author": "NVD", "id": "CVE-2019-17195", "trust": 1.8, "value": "CRITICAL" }, { "author": "CNNVD", "id": "CNNVD-202104-975", "trust": 0.6, "value": "MEDIUM" }, { "author": "CNNVD", "id": "CNNVD-201910-914", "trust": 0.6, "value": "CRITICAL" }, { "author": "VULHUB", "id": "VHN-149417", "trust": 0.1, "value": "MEDIUM" }, { "author": "VULMON", "id": "CVE-2019-17195", "trust": 0.1, "value": "MEDIUM" } ] } ], "sources": [ { "db": "VULHUB", "id": "VHN-149417" }, { "db": "VULMON", "id": "CVE-2019-17195" }, { "db": "JVNDB", "id": "JVNDB-2019-010680" }, { "db": "NVD", "id": "CVE-2019-17195" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "CNNVD", "id": "CNNVD-201910-914" } ] }, "description": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/description#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass. Connect2id Nimbus JOSE+JWT Contains an exceptional condition check vulnerability.Information is obtained, information is altered, and service operation is disrupted (DoS) There is a possibility of being put into a state. Pillow is a Python-based image processing library. \nThere is currently no information about this vulnerability, please feel free to follow CNNVD or manufacturer announcements. Description:\n\nThe org.ovirt.engine-root is a core component of oVirt. \n\nThe following packages have been upgraded to a later upstream version:\norg.ovirt.engine-root (4.3.8.2), ovirt-engine-dwh (4.3.8),\novirt-engine-metrics (1.3.6.1), ovirt-fast-forward-upgrade (1.0.0),\novirt-imageio-common (1.5.3), ovirt-imageio-proxy (1.5.3), ovirt-web-ui\n(1.6.0), rhv-log-collector-analyzer (0.2.15), v2v-conversion-host (1.16.0). \n\nBug Fix(es):\n\n* [downstream clone - 4.4.0] Upgrade from 4.3 to 4.4 will fail if there are\nversioned templates in database (BZ#1688781)\n\n* [ovirt-fast-forward-upgrade] Error:\novirt-engine-setup-plugin-ovirt-engine conflicts with\novirt-engine-4.2.5.2-0.1.el7ev.noarch (BZ#1754979)\n\n* Users immediately logged out from User portal due to negative\nUserSessionTimeOutInterval (BZ#1757423)\n\n* Fluentd error when stopping metrics services through playbook on 4.3\n(BZ#1772506)\n\n* [downstream clone - 4.3.8] From VM Portal, users cannot create Operating\nSystem Windows VM. (BZ#1780234)\n\nEnhancement(s):\n\n* RFE for offline installation of RHV Metrics Store (BZ#1711873)\n\n* [RFE] Compare storage with database for discrepancies (BZ#1739106)\n\n* [RFE] RHV+Metrics Store - Support a Flat DNS environment without\nsubdomains (BZ#1782412)\n\n4. Bugs fixed (https://bugzilla.redhat.com/):\n\n1752522 - ovirt-fast-forward-upgrade: Upgrade from 4.2 to 4.3 fails with UnicodeEncodeError\n1764791 - CVE-2019-17195 nimbus-jose-jwt: Uncaught exceptions while parsing a JWT\n1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default\n1789737 - Import of OVA created from template fails with java.lang.NullPointerException [RHV clone - 4.3.9]\n1792874 - Hide partial engine-cleanup option [RHV clone - 4.3.9]\n1797496 - Add RHCOS os to osinfo - for compatability API between 4.3 to 4.4\n1801310 - Module ovirt disk parameter storage domain has default option in documentation\n1808038 - Unable to change Graphical Console of HE VM. [RHV clone - 4.3.9]\n1808607 - RHVM 4.3.8.2 has Security Vulnerability Tenable Plugin ID 133165 in apache-commons-beanutils-1.8.3-14.el7\n1809470 - [HE] ovirt-provider-ovn is non-functional on 4.3.9 Hosted-Engine [RHV clone - 4.3.9]\n1810527 - Upgrade rhvm-dependencies to 4.3.2\n\n6. -----BEGIN PGP SIGNED MESSAGE-----\nHash: SHA256\n\n=====================================================================\n Red Hat Security Advisory\n\nSynopsis: Important: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update\nAdvisory ID: RHSA-2020:3247-01\nProduct: Red Hat Virtualization\nAdvisory URL: https://access.redhat.com/errata/RHSA-2020:3247\nIssue date: 2020-08-04\nCVE Names: CVE-2017-18635 CVE-2019-8331 CVE-2019-10086 \n CVE-2019-13990 CVE-2019-17195 CVE-2019-19336 \n CVE-2020-7598 CVE-2020-10775 CVE-2020-11022 \n CVE-2020-11023 \n=====================================================================\n\n1. Summary:\n\nUpdated ovirt-engine packages that fix several bugs and add various\nenhancements are now available. \n\nRed Hat Product Security has rated this update as having a security impact\nof Important. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available for each vulnerability\nfrom the CVE link(s) in the References section. \n\n2. Relevant releases/architectures:\n\nRHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4 - noarch, x86_64\n\n3. Description:\n\nThe ovirt-engine package provides the Red Hat Virtualization Manager, a\ncentralized management platform that allows system administrators to view\nand manage virtual machines. The Manager provides a comprehensive range of\nfeatures including search capabilities, resource management, live\nmigrations, and virtual infrastructure provisioning. \n\nThe Manager is a JBoss Application Server application that provides several\ninterfaces through which the virtual environment can be accessed and\ninteracted with, including an Administration Portal, a VM Portal, and a\nRepresentational State Transfer (REST) Application Programming Interface\n(API). \n\nA list of bugs fixed in this update is available in the Technical Notes\nbook:\n\nhttps://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/ht\nml-single/technical_notes\n\nSecurity Fix(es):\n\n* apache-commons-beanutils: does not suppresses the class property in\nPropertyUtilsBean by default (CVE-2019-10086)\n\n* libquartz: XXE attacks via job description (CVE-2019-13990)\n\n* novnc: XSS vulnerability via the messages propagated to the status field\n(CVE-2017-18635)\n\n* bootstrap: XSS in the tooltip or popover data-template attribute\n(CVE-2019-8331)\n\n* nimbus-jose-jwt: Uncaught exceptions while parsing a JWT (CVE-2019-17195)\n\n* ovirt-engine: response_type parameter allows reflected XSS\n(CVE-2019-19336)\n\n* nodejs-minimist: prototype pollution allows adding or modifying\nproperties of Object.prototype using a constructor or __proto__ payload\n(CVE-2020-7598)\n\n* ovirt-engine: Redirect to arbitrary URL allows for phishing\n(CVE-2020-10775)\n\n* Cross-site scripting due to improper injQuery.htmlPrefilter method\n(CVE-2020-11022)\n\n* jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods\ncould result in untrusted code execution (CVE-2020-11023)\n\nFor more details about the security issue(s), including the impact, a CVSS\nscore, acknowledgments, and other related information, refer to the CVE\npage(s) listed in the References section. \n\n4. Solution:\n\nBefore applying this update, make sure all previously released errata\nrelevant to your system have been applied. \n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/2974891\n\n5. Bugs fixed (https://bugzilla.redhat.com/):\n\n1080097 - [RFE] Allow editing disks details in the Disks tab\n1325468 - [RFE] Autostart of VMs that are down (with Engine assistance - Engine has to be up)\n1358501 - [RFE] multihost network change - notify when done\n1427717 - [RFE] Create and/or select affinity group upon VM creation. \n1475774 - RHV-M requesting four GetDeviceListVDSCommand when editing storage domain\n1507438 - not able to deploy new rhvh host when \"/tmp\" is mounted with \"noexec\" option\n1523835 - Hosted-Engine: memory hotplug does not work for engine vm\n1527843 - [Tracker] Q35 chipset support (with seabios)\n1529042 - [RFE] Changing of Cluster CPU Type does not trigger config update notification\n1535796 - Undeployment of HE is not graceful\n1546838 - [RFE] Refuse to deploy on localhost.localdomain\n1547937 - [RFE] Live Storage Migration progress bar. \n1585986 - [HE] When lowering the cluster compatibility, we need to force update the HE storage OVF store to ensure it can start up (migration will not work). \n1593800 - [RFE] forbid new mac pools with overlapping ranges\n1596178 - inconsistent display between automatic and manual Pool Type\n1600059 - [RFE] Add by default a storage lease to HA VMs\n1610212 - After updating to RHV 4.1 while trying to edit the disk, getting error \"Cannot edit Virtual Disk. Cannot edit Virtual Disk. Disk extension combined with disk compat version update isn\u0027t supported. Please perform the updates separately.\"\n1611395 - Unable to list Compute Templates in RHV 4.2 from Satellite 6.3.2\n1616451 - [UI] add a tooltip to explain the supported matrix for the combination of disk allocation policies, formats and the combination result\n1637172 - Live Merge hung in the volume deletion phase, leaving snapshot in a LOCKED state\n1640908 - Javascript Error popup when Managing StorageDomain with LUNs and 400+ paths\n1642273 - [UI] - left nav border highlight missing in RHV\n1647440 - [RFE][UI] Provide information about the VM next run\n1648345 - Jobs are not properly cleaned after a failed task. \n1650417 - HA is broken for VMs having disks in NFS storage domain because of Qemu OFD locking\n1650505 - Increase of ClusterCompatibilityVersion to Cluster with virtual machines with outstanding configuration changes, those changes will be reverted\n1651406 - [RFE] Allow Maintenance of Host with Enforcing VM Affinity Rules (hard affinity)\n1651939 - a new size of the direct LUN not updated in Admin Portal\n1654069 - [Downstream Clone] [UI] - grids bottom scrollbar hides bottom row\n1654889 - [RFE] Support console VNC for mediated devices\n1656621 - Importing VM OVA always enables \u0027Cloud-Init/Sysprep\u0027\n1658101 - [RESTAPI] Adding ISO disables serial console\n1659161 - Unable to edit pool that is delete protected\n1660071 - Regression in Migration of VM that starts in pause mode: took 11 hours\n1660644 - Concurrent LSMs of the same disk can be issued via the REST-API\n1663366 - USB selection option disabled even though USB support is enabled in RHV-4.2\n1664479 - Third VM fails to get migrated when host is placed into maintenance mode\n1666913 - [UI] warn users about different \"Vdsm Name\" when creating network with a fancy char or long name\n1670102 - [CinderLib] - openstack-cinder and cinderlib packages are not installed on ovirt-engine machine\n1671876 - \"Bond Active Slave\" parameter on RHV-M GUI shows an incorrect until Refresh Caps\n1679039 - Unable to upload image through Storage-\u003eDomain-\u003eDisk because of wrong DC\n1679110 - [RFE] change Admin Portal toast notifications location\n1679471 - [ja, de, es, fr, pt_BR] The console client resources page shows truncated title for some locales\n1679730 - Warn about host IP addresses outside range\n1686454 - CVE-2019-8331 bootstrap: XSS in the tooltip or popover data-template attribute\n1686650 - Memory snapshots\u0027 deletion logging unnecessary WARNINGS in engine.log\n1687345 - Snapshot with memory volumes can fail if the memory dump takes more than 180 seconds\n1690026 - [RFE] - Creating an NFS storage domain the engine should let the user specify exact NFS version v4.0 and not just v4\n1690155 - Disk migration progress bar not clearly visible and unusable. \n1690475 - When a live storage migration fails, the auto generated snapshot does not get removed\n1691562 - Cluster level changes are not increasing VMs generation numbers and so a new OVF_STORE content is not copied to the shared storage\n1692592 - \"\ufffcEnable menu to select boot device shows 10 device listed with cdrom at 10th slot but when selecting 10 option the VM took 1 as option and boot with disk\n1693628 - Engine generates too many updates to vm_dynamic table due to the session change\n1693813 - Do not change DC level if there are VMs running/paused with older CL. \n1695026 - Failure in creating snapshots during \"Live Storage Migration\" can result in a nonexistent snapshot\n1695635 - [RFE] Improve Host Drop-down menu in different Dialogs (i.e. Alphabetical sort of Hosts in Remove|New StorageDomains)\n1696245 - [RFE] Allow full customization while cloning a VM\n1696669 - Build bouncycastle for RHV 4.4 RHEL 8\n1696676 - Build ebay-cors-filter for RHV 4.4 RHEL 8\n1698009 - Build openstack-java-sdk for RHV 4.4 RHEL 8\n1698102 - Print a warning message to engine-setup, which highlights that other clusters than the Default one are not modified to use ovirt-provider-ovn as the default network provider\n1700021 - [RFE] engine-setup should warn and prompt if ca.pem is missing but other generated pki files exist\n1700036 - [RFE] Add RedFish API for host power management for RHEV\n1700319 - VM is going to pause state with \"storage I/O error\". \n1700338 - [RFE] Alternate method to configure the email Event Notifier for a user in RHV through API (instead of RHV GUI)\n1700725 - [scale] RHV-M runs out of memory due to to much data reported by the guest agent\n1700867 - Build makeself for RHV 4.4 RHEL 8\n1701476 - Build unboundid-ldapsdk for RHV 4.4 RHEL 8\n1701491 - Build RHV-M 4.4 - RHEL 8\n1701522 - Build ovirt-imageio-proxy for RHV 4.4 / RHEL 8\n1701528 - Build / Tag python-ovsdbapp for RHV 4.4 RHEL 8\n1701530 - Build / Tag ovirt-cockpit-sso for RHV 4.4 RHEL 8\n1701531 - Build / Tag ovirt-engine-api-explorer for RHV 4.4 RHEL 8\n1701533 - Build / Tag ovirt-engine-dwh for RHV 4.4 / RHEL 8\n1701538 - Build / Tag vdsm-jsonrpc-java for RHV 4.4 RHEL 8\n1701544 - Build rhvm-dependencies for RHV 4.4 RHEL 8\n1702310 - Build / Tag ovirt-engine-ui-extensions for RHV 4.4 RHEL 8\n1702312 - Build ovirt-log-collector for RHV 4.4 RHEL 8\n1703112 - PCI address of NICs are not stored in the database after a hotplug of passthrough NIC resulting in change of network device name in VM after a reboot\n1703428 - VMs migrated from KVM to RHV show warning \u0027The latest guest agent needs to be installed and running on the guest\u0027\n1707225 - [cinderlib] Cinderlib DB is missing a backup and restore option\n1708624 - Build rhvm-setup-plugins for RHV 4.4 - RHEL 8\n1710491 - No EVENT_ID is generated in /var/log/ovirt-engine/engine.log when VM is rebooted from OS level itself. \n1711006 - Metrics installation fails during the execution of playbook ovirt-metrics-store-installation if the environment is not having DHCP\n1712255 - Drop 4.1 datacenter/cluster level\n1712746 - [RFE] Ignition support for ovirt vms\n1712890 - engine-setup should check for snapshots in unsupported CL\n1714528 - Missing IDs on cluster upgrade buttons\n1714633 - Using more than one asterisk in the search string is not working when searching for users. \n1714834 - Cannot disable SCSI passthrough using API\n1715725 - Sending credentials in query string logs them in ovirt-request-logs\n1716590 - [RFE][UX] Make Cluster-wide \"Custom serial number policy\" value visible at VM level\n1718818 - [RFE] Enhance local disk passthrough\n1720686 - Tag ovirt-scheduler-proxy for RHV 4.4 RHEL 8\n1720694 - Build ovirt-engine-extension-aaa-jdbc for RHV 4.4 RHEL 8\n1720795 - New guest tools are available mark in case of guest tool located on Data Domain\n1724959 - RHV recommends reporting issues to GitHub rather than access.redhat.com (ovirt-\u003eRHV rebrand glitch?)\n1727025 - NPE in DestroyImage endAction during live merge leaving a task in DB for hours causing operations depending on host clean tasks to fail as Deactivate host/StopSPM/deactivate SD\n1728472 - Engine reports network out of sync due to ipv6 default gateway via ND RA on a non default route network. \n1729511 - engine-setup fails to upgrade to 4.3 with Unicode characters in CA subject\n1729811 - [scale] updatevmdynamic broken if too many users logged in - psql ERROR: value too long for type character varying(255)\n1730264 - VMs will fail to start if the vnic profile attached is having port mirroring enabled and have name greater than 15 characters\n1730436 - Snapshot creation was successful, but snapshot remains locked\n1731212 - RHV 4.4 landing page does not show login or allow scrolling. \n1731590 - Cannot preview snapshot, it fails and VM remains locked. \n1733031 - [RFE] Add warning when importing data domains to newer DC that may trigger SD format upgrade\n1733529 - Consume python-ovsdbapp dependencies from OSP in RHEL 8 RHV 4.4\n1733843 - Export to OVA fails if VM is running on the Host doing the export\n1734839 - Unable to start guests in our Power9 cluster without running in headless mode. \n1737234 - Attach a non-existent ISO to vm by the API return 201 and marks the Attach CD checkbox as ON\n1737684 - Engine deletes the leaf volume when SnapshotVDSCommand timed out without checking if the volume is still used by the VM\n1740978 - [RFE] Warn or Block importing VMs/Templates from unsupported compatibility levels. \n1741102 - host activation causes RHHI nodes to lose the quorum\n1741271 - Move/Copy disk are blocked if there is less space in source SD than the size of the disk\n1741625 - VM fails to be re-started with error: Failed to acquire lock: No space left on device\n1743690 - Commit and Undo buttons active when no snapshot selected\n1744557 - RHV 4.3 throws an exception when trying to access VMs which have snapshots from unsupported compatibility levels\n1745384 - [IPv6 Static] Engine should allow updating network\u0027s static ipv6gateway\n1745504 - Tag rhv-log-collector-analyzer for RHV 4.4 RHEL 8\n1746272 - [BREW BUILD ENABLER] Build the oVirt Ansible roles for RHV 4.4.0\n1746430 - [Rebase] Rebase v2v-conversion-host for RHV 4.4 Engine\n1746877 - [Metrics] Rebase bug - for the 4.4 release on EL8\n1747772 - Extra white space at the top of webadmin dialogs\n1749284 - Change the Snapshot operation to be asynchronous\n1749944 - teardownImage attempts to deactivate in-use LV\u0027s rendering the VM disk image/volumes in locked state. \n1750212 - MERGE_STATUS fails with \u0027Invalid UUID string: mapper\u0027 when Direct LUN that already exists is hot-plugged\n1750348 - [Tracking] rhvm-branding-rhv for RHV 4.4\n1750357 - [Tracking] ovirt-web-ui for RHV 4.4\n1750371 - [Tracking] ovirt-engine-ui-extensions for RHV 4.4\n1750482 - From VM Portal, users cannot create Operating System Windows VM. \n1751215 - Unable to change Graphical Console of HE VM. \n1751268 - add links to Insights to landing page\n1751423 - Improve description of shared memory statistics and remove unimplemented memory metrics from API\n1752890 - Build / Tag ovirt-engine-extension-aaa-ldap for RHV 4.4 RHEL 8\n1752995 - [RFE] Need to be able to set default console option\n1753629 - Build / Tag ovirt-engine-extension-aaa-misc for RHV 4.4 RHEL 8\n1753661 - Build / Tag ovirt-engine-extension-logger-log4j got RHV 4.4 / RHEl 8\n1753664 - Build ovirt-fast-forward-upgrade for RHV 4.4 /RHEL 8 support\n1754363 - [Scale] Engine generates excessive amount of dns configuration related sql queries\n1754490 - RHV Manager cannot start on EAP 7.2.4\n1755412 - Setting \"oreg_url: registry.redhat.io\" fails with error\n1758048 - clone(as thin) VM from template or create snapshot fails with \u0027Requested capacity 1073741824 \u003c parent capacity 3221225472 (volume:1211)\u0027\n1758289 - [Warn] Duplicate chassis entries in southbound database if the host is down while removing the host from Manager\n1762281 - Import of OVA created from template fails with java.lang.NullPointerException\n1763992 - [RFE] Show \"Open Console\" as the main option in the VM actions menu\n1764289 - Document details how each fence agent can be configured in RESTAPI\n1764791 - CVE-2019-17195 nimbus-jose-jwt: Uncaught exceptions while parsing a JWT\n1764932 - [BREW BUILD ENABLER] Build the ansible-runner-service for RHV 4.4\n1764943 - Create Snapshot does not proceed beyond CreateVolume\n1764959 - Apache is configured to offer TRACE method (security)\n1765660 - CVE-2017-18635 novnc: XSS vulnerability via the messages propagated to the status field\n1767319 - [RFE] forbid updating mac pool that contains ranges overlapping with any mac range in the system\n1767483 - CVE-2019-10086 apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default\n1768707 - Cannot set or update iscsi portal group tag when editing storage connection via API\n1768844 - RHEL Advanced virtualization module streams support\n1769463 - [Scale] Slow performance for api/clusters when many networks devices are present\n1770237 - Cannot assign a vNIC profile for VM instance profile. \n1771793 - VM Portal crashes in what appears to be a permission related problem. \n1773313 - RHV Metric store installation fails with error: \"You need to install \\\"jmespath\\\" prior to running json_query filter\"\n1777954 - VM Templates greater then 101 quantity are not listed/reported in RHV-M Webadmin UI. \n1779580 - drop rhvm-doc package\n1781001 - CVE-2019-19336 ovirt-engine: response_type parameter allows reflected XSS\n1782236 - Windows Update (the drivers) enablement\n1782279 - Warning message for low space is not received on Imported Storage domain\n1782882 - qemu-kvm: kvm_init_vcpu failed: Function not implemented\n1784049 - Rhel6 guest with cluster default q35 chipset causes kernel panic\n1784385 - Still requiring rhvm-doc in rhvm-setup-plugins\n1785750 - [RFE] Ability to change default VM action (Suspend) in the VM Portal. \n1788424 - Importing a VM having direct LUN attached using virtio driver is failing with error \"VirtIO-SCSI is disabled for the VM\"\n1796809 - Build apache-sshd for RHV 4.4 RHEL 8\n1796811 - Remove bundled apache-sshd library\n1796815 - Build snmp4j for RHV 4.4 RHEL 8\n1796817 - Remove bundled snmp4j library\n1797316 - Snapshot creation from VM fails on second snapshot and afterwords\n1797500 - Add disk operation failed to complete. \n1798114 - Build apache-commons-digester for RHV 4.4 RHEL 8\n1798117 - Build apache-commons-configuration for RHV 4.4 RHEL 8\n1798120 - Build apache-commons-jexl for RHV 4.4 RHEL 8\n1798127 - Build apache-commons-collections4 for RHV 4.4 RHEL 8\n1798137 - Build apache-commons-vfs for RHV 4.4 RHEL 8\n1799171 - Build ws-commons-util for RHV 4.4 RHEL 8\n1799204 - Build xmlrpc for RHV 4.4 RHEL 8\n1801149 - CVE-2019-13990 libquartz: XXE attacks via job description\n1801709 - Disable activation of the host while Enroll certificate flow is still in progress\n1803597 - rhv-image-discrepancies should skip storage domains in maintenance mode and ISO/Export\n1805669 - change requirement on rhvm package from spice-client-msi to spice-client-win\n1806276 - [HE] ovirt-provider-ovn is non-functional on 4.3.9 Hosted-Engine\n1807047 - Build m2crypto for RHV 4.4 RHEL 8\n1807860 - [RFE] Allow resource allocation options to be customized\n1808096 - Uploading ISOs causes \"Uncaught exception occurred. Please try reloading the page. Details: (TypeError) : a.n is null\"\n1808126 - host_service.install() does not work with deploy_hosted_engine as True. \n1809040 - [CNV\u0026RHV] let the user know that token is not valid anymore\n1809052 - [CNV\u0026RHV] ovirt-engine log file spammed by failed timers ( approx 3-5 messages/sec )\n1809875 - rhv-image-discrepancies only compares images on the last DC\n1809877 - rhv-image-discrepancies sends dump-volume-chains with parameter that is ignored\n1810893 - mountOptions is ignored for \"import storage domain\" from GUI\n1811865 - [Scale] Host Monitoring generates excessive amount of qos related sql queries\n1811869 - [Scale] Webadmin\\REST for host interface list response time is too long because of excessive amount of qos related sql queries\n1812875 - Unable to create VMs when french Language is selected for the rhvm gui. \n1813305 - Engine updating SLA policies of VMs continuously in an environment which is not having any QOS configured\n1813344 - CVE-2020-7598 nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or __proto__ payload\n1814197 - [CNV\u0026RHV] when provider is remover DC is left behind and active\n1814215 - [CNV\u0026RHV] Adding new provider to engine fails after succesfull test\n1816017 - Build log4j12 for RHV 4.4 EL8\n1816643 - [CNV\u0026RHV] VM created in CNV not visible in RHV\n1816654 - [CNV\u0026RHV] adding provider with already created vm failed\n1816693 - [CNV\u0026RHV] CNV VM failed to restart even if 1st dialog looks fine\n1816739 - [CNV\u0026RHV] CNV VM updated form CNV side doesn\u0027t update vm properties over on RHV side\n1817467 - [Tracking] Migration path between RHV 4.3 and 4.4\n1818745 - rhv-log-collector-analyzer 0.2.17 still requires pyhton2\n1819201 - [CodeChange][i18n] oVirt 4.4 rhv branding - translation update\n1819248 - Cannot upgrade host after engine setup\n1819514 - Failed to register 4.4 host to the latest engine (4.4.0-0.29.master.el8ev)\n1819960 - NPE on ImportVmTemplateFromConfigurationCommand when creating VM from ovf_data\n1820621 - Build apache-commons-compress for RHV 4.4 EL8\n1820638 - Build apache-commons-jxpath for RHV 4.4 EL8\n1821164 - Failed snapshot creation can cause data corruption of other VMs\n1821930 - Enable only TLSv1.2+ protocol for SPICE on EL7 hosts\n1824095 - VM portal shows only error\n1825793 - RHV branding is missing after upgrade from 4.3\n1826248 - [4.4][ovirt-cockpit-sso] Compatibility issues with python3\n1826437 - The console client resources page return HTTP code 500\n1826801 - [CNV\u0026RHV] update of memory on cnv side does not propagate to rhv\n1826855 - [cnv\u0026rhv] update of cpu on cnv side causing expetion in engine.log\n1828406 - CVE-2020-11022 jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method\n1828669 - After SPM select the engine lost communication to all hosts until restarted [improved logging]\n1828736 - [CNV\u0026RHV] cnv template is not propagated to rhv\n1829189 - engine-setup httpd ssl configuration conflicts with Red Hat Insights\n1829656 - Failed to register 4.3 host to 4.4 engine with 4.3 cluster (4.4.0-0.33.master.el8ev)\n1829830 - vhost custom properties does not accept \u0027-\u0027\n1832161 - rhv-log-collector-analyzer fails with UnicodeDecodeError on RHEL8\n1834523 - Edit VM -\u003e Enable Smartcard sharing does not stick when VM is running\n1838493 - Live snapshot made with freeze in the engine will cause the FS to be frozen\n1841495 - Upgrade openstack-java-sdk to 3.2.9\n1842495 - high cpu usage after entering wrong search pattern in RHVM\n1844270 - [vGPU] nodisplay option for mdev broken since mdev scheduling unit\n1844855 - Missing images (favicon.ico, banner logo) and missing brand.css file on VM portal d/s installation\n1845473 - Exporting an OVA file from a VM results in its ovf file having a format of RAW when the disk is COW\n1847420 - CVE-2020-10775 ovirt-engine: Redirect to arbitrary URL allows for phishing\n1850004 - CVE-2020-11023 jQuery: passing HTML containing \u003coption\u003e elements to manipulation methods could result in untrusted code execution\n1853444 - [CodeChange][i18n] oVirt 4.4 rhv branding - translation update (July-2020)\n1854563 - [4.4 downstream only][RFE] Include a link to grafana on front page\n\n6. Package List:\n\nRHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4:\n\nSource:\nansible-runner-1.4.5-1.el8ar.src.rpm\nansible-runner-service-1.0.2-1.el8ev.src.rpm\napache-commons-collections4-4.4-1.el8ev.src.rpm\napache-commons-compress-1.18-1.el8ev.src.rpm\napache-commons-configuration-1.10-1.el8ev.src.rpm\napache-commons-jexl-2.1.1-1.el8ev.src.rpm\napache-commons-jxpath-1.3-29.el8ev.src.rpm\napache-commons-vfs-2.4.1-1.el8ev.src.rpm\napache-sshd-2.5.1-1.el8ev.src.rpm\nebay-cors-filter-1.0.1-4.el8ev.src.rpm\ned25519-java-0.3.0-1.el8ev.src.rpm\nengine-db-query-1.6.1-1.el8ev.src.rpm\njava-client-kubevirt-0.5.0-1.el8ev.src.rpm\nlog4j12-1.2.17-22.el8ev.src.rpm\nm2crypto-0.35.2-5.el8ev.src.rpm\nmakeself-2.4.0-4.el8ev.src.rpm\nnovnc-1.1.0-1.el8ost.src.rpm\nopenstack-java-sdk-3.2.9-1.el8ev.src.rpm\novirt-cockpit-sso-0.1.4-1.el8ev.src.rpm\novirt-engine-4.4.1.8-0.7.el8ev.src.rpm\novirt-engine-api-explorer-0.0.6-1.el8ev.src.rpm\novirt-engine-dwh-4.4.1.2-1.el8ev.src.rpm\novirt-engine-extension-aaa-jdbc-1.2.0-1.el8ev.src.rpm\novirt-engine-extension-aaa-ldap-1.4.0-1.el8ev.src.rpm\novirt-engine-extension-aaa-misc-1.1.0-1.el8ev.src.rpm\novirt-engine-extension-logger-log4j-1.1.0-1.el8ev.src.rpm\novirt-engine-extensions-api-1.0.1-1.el8ev.src.rpm\novirt-engine-metrics-1.4.1.1-1.el8ev.src.rpm\novirt-engine-ui-extensions-1.2.2-1.el8ev.src.rpm\novirt-fast-forward-upgrade-1.1.6-0.el8ev.src.rpm\novirt-log-collector-4.4.2-1.el8ev.src.rpm\novirt-scheduler-proxy-0.1.9-1.el8ev.src.rpm\novirt-web-ui-1.6.3-1.el8ev.src.rpm\npython-aniso8601-0.82-4.el8ost.src.rpm\npython-flask-1.0.2-2.el8ost.src.rpm\npython-flask-restful-0.3.6-8.el8ost.src.rpm\npython-netaddr-0.7.19-8.1.el8ost.src.rpm\npython-notario-0.0.16-2.el8cp.src.rpm\npython-ovsdbapp-0.17.1-0.20191216120142.206cf14.el8ost.src.rpm\npython-pbr-5.1.2-2.el8ost.src.rpm\npython-six-1.12.0-1.el8ost.src.rpm\npython-websocket-client-0.54.0-1.el8ost.src.rpm\npython-werkzeug-0.16.0-1.el8ost.src.rpm\nrhv-log-collector-analyzer-1.0.2-1.el8ev.src.rpm\nrhvm-branding-rhv-4.4.4-1.el8ev.src.rpm\nrhvm-dependencies-4.4.0-1.el8ev.src.rpm\nrhvm-setup-plugins-4.4.2-1.el8ev.src.rpm\nsnmp4j-2.4.1-1.el8ev.src.rpm\nunboundid-ldapsdk-4.0.14-1.el8ev.src.rpm\nvdsm-jsonrpc-java-1.5.4-1.el8ev.src.rpm\nws-commons-util-1.0.2-1.el8ev.src.rpm\nxmlrpc-3.1.3-1.el8ev.src.rpm\n\nnoarch:\nansible-runner-1.4.5-1.el8ar.noarch.rpm\nansible-runner-service-1.0.2-1.el8ev.noarch.rpm\napache-commons-collections4-4.4-1.el8ev.noarch.rpm\napache-commons-collections4-javadoc-4.4-1.el8ev.noarch.rpm\napache-commons-compress-1.18-1.el8ev.noarch.rpm\napache-commons-compress-javadoc-1.18-1.el8ev.noarch.rpm\napache-commons-configuration-1.10-1.el8ev.noarch.rpm\napache-commons-jexl-2.1.1-1.el8ev.noarch.rpm\napache-commons-jexl-javadoc-2.1.1-1.el8ev.noarch.rpm\napache-commons-jxpath-1.3-29.el8ev.noarch.rpm\napache-commons-jxpath-javadoc-1.3-29.el8ev.noarch.rpm\napache-commons-vfs-2.4.1-1.el8ev.noarch.rpm\napache-commons-vfs-ant-2.4.1-1.el8ev.noarch.rpm\napache-commons-vfs-examples-2.4.1-1.el8ev.noarch.rpm\napache-commons-vfs-javadoc-2.4.1-1.el8ev.noarch.rpm\napache-sshd-2.5.1-1.el8ev.noarch.rpm\napache-sshd-javadoc-2.5.1-1.el8ev.noarch.rpm\nebay-cors-filter-1.0.1-4.el8ev.noarch.rpm\ned25519-java-0.3.0-1.el8ev.noarch.rpm\ned25519-java-javadoc-0.3.0-1.el8ev.noarch.rpm\nengine-db-query-1.6.1-1.el8ev.noarch.rpm\njava-client-kubevirt-0.5.0-1.el8ev.noarch.rpm\nlog4j12-1.2.17-22.el8ev.noarch.rpm\nlog4j12-javadoc-1.2.17-22.el8ev.noarch.rpm\nmakeself-2.4.0-4.el8ev.noarch.rpm\nnovnc-1.1.0-1.el8ost.noarch.rpm\nopenstack-java-ceilometer-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-ceilometer-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-cinder-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-cinder-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-glance-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-glance-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-heat-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-heat-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-javadoc-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-keystone-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-keystone-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-nova-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-nova-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-quantum-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-quantum-model-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-resteasy-connector-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-swift-client-3.2.9-1.el8ev.noarch.rpm\nopenstack-java-swift-model-3.2.9-1.el8ev.noarch.rpm\novirt-cockpit-sso-0.1.4-1.el8ev.noarch.rpm\novirt-engine-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-api-explorer-0.0.6-1.el8ev.noarch.rpm\novirt-engine-backend-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-dbscripts-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-dwh-4.4.1.2-1.el8ev.noarch.rpm\novirt-engine-dwh-grafana-integration-setup-4.4.1.2-1.el8ev.noarch.rpm\novirt-engine-dwh-setup-4.4.1.2-1.el8ev.noarch.rpm\novirt-engine-extension-aaa-jdbc-1.2.0-1.el8ev.noarch.rpm\novirt-engine-extension-aaa-ldap-1.4.0-1.el8ev.noarch.rpm\novirt-engine-extension-aaa-ldap-setup-1.4.0-1.el8ev.noarch.rpm\novirt-engine-extension-aaa-misc-1.1.0-1.el8ev.noarch.rpm\novirt-engine-extension-logger-log4j-1.1.0-1.el8ev.noarch.rpm\novirt-engine-extensions-api-1.0.1-1.el8ev.noarch.rpm\novirt-engine-extensions-api-javadoc-1.0.1-1.el8ev.noarch.rpm\novirt-engine-health-check-bundler-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-metrics-1.4.1.1-1.el8ev.noarch.rpm\novirt-engine-restapi-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-base-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-cinderlib-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-imageio-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-ovirt-engine-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-ovirt-engine-common-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-vmconsole-proxy-helper-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-setup-plugin-websocket-proxy-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-tools-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-tools-backup-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-ui-extensions-1.2.2-1.el8ev.noarch.rpm\novirt-engine-vmconsole-proxy-helper-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-webadmin-portal-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-engine-websocket-proxy-4.4.1.8-0.7.el8ev.noarch.rpm\novirt-fast-forward-upgrade-1.1.6-0.el8ev.noarch.rpm\novirt-log-collector-4.4.2-1.el8ev.noarch.rpm\novirt-scheduler-proxy-0.1.9-1.el8ev.noarch.rpm\novirt-web-ui-1.6.3-1.el8ev.noarch.rpm\npython-flask-doc-1.0.2-2.el8ost.noarch.rpm\npython2-netaddr-0.7.19-8.1.el8ost.noarch.rpm\npython2-pbr-5.1.2-2.el8ost.noarch.rpm\npython2-six-1.12.0-1.el8ost.noarch.rpm\npython3-aniso8601-0.82-4.el8ost.noarch.rpm\npython3-ansible-runner-1.4.5-1.el8ar.noarch.rpm\npython3-flask-1.0.2-2.el8ost.noarch.rpm\npython3-flask-restful-0.3.6-8.el8ost.noarch.rpm\npython3-netaddr-0.7.19-8.1.el8ost.noarch.rpm\npython3-notario-0.0.16-2.el8cp.noarch.rpm\npython3-ovirt-engine-lib-4.4.1.8-0.7.el8ev.noarch.rpm\npython3-ovsdbapp-0.17.1-0.20191216120142.206cf14.el8ost.noarch.rpm\npython3-pbr-5.1.2-2.el8ost.noarch.rpm\npython3-six-1.12.0-1.el8ost.noarch.rpm\npython3-websocket-client-0.54.0-1.el8ost.noarch.rpm\npython3-werkzeug-0.16.0-1.el8ost.noarch.rpm\npython3-werkzeug-doc-0.16.0-1.el8ost.noarch.rpm\nrhv-log-collector-analyzer-1.0.2-1.el8ev.noarch.rpm\nrhvm-4.4.1.8-0.7.el8ev.noarch.rpm\nrhvm-branding-rhv-4.4.4-1.el8ev.noarch.rpm\nrhvm-dependencies-4.4.0-1.el8ev.noarch.rpm\nrhvm-setup-plugins-4.4.2-1.el8ev.noarch.rpm\nsnmp4j-2.4.1-1.el8ev.noarch.rpm\nsnmp4j-javadoc-2.4.1-1.el8ev.noarch.rpm\nunboundid-ldapsdk-4.0.14-1.el8ev.noarch.rpm\nunboundid-ldapsdk-javadoc-4.0.14-1.el8ev.noarch.rpm\nvdsm-jsonrpc-java-1.5.4-1.el8ev.noarch.rpm\nws-commons-util-1.0.2-1.el8ev.noarch.rpm\nws-commons-util-javadoc-1.0.2-1.el8ev.noarch.rpm\nxmlrpc-client-3.1.3-1.el8ev.noarch.rpm\nxmlrpc-common-3.1.3-1.el8ev.noarch.rpm\nxmlrpc-javadoc-3.1.3-1.el8ev.noarch.rpm\nxmlrpc-server-3.1.3-1.el8ev.noarch.rpm\n\nx86_64:\nm2crypto-debugsource-0.35.2-5.el8ev.x86_64.rpm\npython3-m2crypto-0.35.2-5.el8ev.x86_64.rpm\npython3-m2crypto-debuginfo-0.35.2-5.el8ev.x86_64.rpm\n\nThese packages are GPG signed by Red Hat for security. Our key and\ndetails on how to verify the signature are available from\nhttps://access.redhat.com/security/team/key/\n\n7. References:\n\nhttps://access.redhat.com/security/cve/CVE-2017-18635\nhttps://access.redhat.com/security/cve/CVE-2019-8331\nhttps://access.redhat.com/security/cve/CVE-2019-10086\nhttps://access.redhat.com/security/cve/CVE-2019-13990\nhttps://access.redhat.com/security/cve/CVE-2019-17195\nhttps://access.redhat.com/security/cve/CVE-2019-19336\nhttps://access.redhat.com/security/cve/CVE-2020-7598\nhttps://access.redhat.com/security/cve/CVE-2020-10775\nhttps://access.redhat.com/security/cve/CVE-2020-11022\nhttps://access.redhat.com/security/cve/CVE-2020-11023\nhttps://access.redhat.com/security/updates/classification/#important\nhttps://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html-single/technical_notes\n\n8. Contact:\n\nThe Red Hat security contact is \u003csecalert@redhat.com\u003e. More contact\ndetails at https://access.redhat.com/security/team/contact/\n\nCopyright 2020 Red Hat, Inc. \n-----BEGIN PGP SIGNATURE-----\nVersion: GnuPG v1\n\niQIVAwUBXylir9zjgjWX9erEAQii/A//bJm3u0+ul+LdQwttSJJ79OdVqcp3FktP\ntdPj8AFbB6F9KkuX9FAQja0/2pgZAldB3Eyz57GYTxyDD1qeMqYSayGHCH01GWAn\nu8uF90lcSz6YvgEPDh1mWhLYQMfdWT6IUuKOEHldt8TyHbc7dX3xCbsLDzNCxGbl\nQuPSFPQBJaAXETSw42NGzdUzaM9zoQ0Mngj+Owcgw53YyBy3BSLAb5bKuijvkcLy\nSVCAxxiQ89E+cnETKYIv4dOfqXGA5wLg68hDmUQyFcXHA9nQbJM9Q0s1fbZ2Wav1\noGGTqJDTgVElxrHB5pYJ6pu484ZgJealkBCrHA2OBsMJUadwitVvQLXFZF5OyN0N\nf/vtZ1ua4mZADa61qfnlmVRiyISwmPPWIOImA3TIE5Q8Yl5ucCqtDjQPoJAbXsUl\nY22Bb5x7JyrN0nyOgwh6BGGK51CmOaP+xNuWD7osI24pnzdmPTZuJrZLePxgPgac\nWWQNznzvokknva2ofvujAm+DEl+W7W3A8Vs9wkmUWYlaVC7GFLEkcvQjjHahZ7kh\ndVJNoh70vpA+aJCMQHYK6MGtCSAWoqXkRTsHb3Stfm2vLLz6GYxY5OuvB7Z0ME1N\nzCiFjBla5+3nKx5ab8Pola56T1wRULHL6zYN9GTsOzxjdJsKHXBVeV8OYcnoHiza\n2TrKn2dtZwI=\n=92Q3\n-----END PGP SIGNATURE-----\n\n--\nRHSA-announce mailing list\nRHSA-announce@redhat.com\nhttps://www.redhat.com/mailman/listinfo/rhsa-announce\n", "sources": [ { "db": "NVD", "id": "CVE-2019-17195" }, { "db": "JVNDB", "id": "JVNDB-2019-010680" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "VULHUB", "id": "VHN-149417" }, { "db": "VULMON", "id": "CVE-2019-17195" }, { "db": "PACKETSTORM", "id": "157073" }, { "db": "PACKETSTORM", "id": "158750" } ], "trust": 2.52 }, "external_ids": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/external_ids#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "db": "NVD", "id": "CVE-2019-17195", "trust": 2.8 }, { "db": "PACKETSTORM", "id": "158750", "trust": 0.8 }, { "db": "JVNDB", "id": "JVNDB-2019-010680", "trust": 0.8 }, { "db": "PACKETSTORM", "id": "157073", "trust": 0.7 }, { "db": "CS-HELP", "id": "SB2021041363", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-202104-975", "trust": 0.6 }, { "db": "CS-HELP", "id": "SB2022042539", "trust": 0.6 }, { "db": "CS-HELP", "id": "SB2021042519", "trust": 0.6 }, { "db": "CS-HELP", "id": "SB2021072766", "trust": 0.6 }, { "db": "CS-HELP", "id": "SB2022072128", "trust": 0.6 }, { "db": "CS-HELP", "id": "SB2021072145", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2021.1519", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.2694", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.1427", "trust": 0.6 }, { "db": "AUSCERT", "id": "ESB-2020.1193", "trust": 0.6 }, { "db": "CNNVD", "id": "CNNVD-201910-914", "trust": 0.6 }, { "db": "VULHUB", "id": "VHN-149417", "trust": 0.1 }, { "db": "VULMON", "id": "CVE-2019-17195", "trust": 0.1 } ], "sources": [ { "db": "VULHUB", "id": "VHN-149417" }, { "db": "VULMON", "id": "CVE-2019-17195" }, { "db": "JVNDB", "id": "JVNDB-2019-010680" }, { "db": "PACKETSTORM", "id": "157073" }, { "db": "PACKETSTORM", "id": "158750" }, { "db": "NVD", "id": "CVE-2019-17195" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "CNNVD", "id": "CNNVD-201910-914" } ] }, "id": "VAR-201910-1730", "iot": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/iot#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": true, "sources": [ { "db": "VULHUB", "id": "VHN-149417" } ], "trust": 0.01 }, "last_update_date": "2023-12-18T11:12:02.963000Z", "patch": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/patch#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "title": "SECURITY-CHANGELOG", "trust": 0.8, "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/security-changelog.txt" }, { "title": "Nimbus JOSE+JWT 7.9 fixes an unchecked exception vulnerability", "trust": 0.8, "url": "https://connect2id.com/blog/nimbus-jose-jwt-7-9" }, { "title": "Connect2id Nimbus JOSE+JWT Security vulnerabilities", "trust": 0.6, "url": "http://www.cnnvd.org.cn/web/xxk/bdxqbyid.tag?id=100510" }, { "title": "Red Hat: Low: Red Hat Virtualization Engine security, bug fix 4.3.9", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20201308 - security advisory" }, { "title": "Red Hat: Important: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=red_hat_security_advisories\u0026qid=rhsa-20203247 - security advisory" }, { "title": "IBM: Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=ibm_psirt_blog\u0026qid=22fc4d0a2671b6a2b6b740928ccb3e85" }, { "title": "Hitachi Security Advisories: Multiple Vulnerabilities in Hitachi Ops Center Common Services", "trust": 0.1, "url": "https://vulmon.com/vendoradvisory?qidtp=hitachi_security_advisories\u0026qid=hitachi-sec-2021-124" }, { "title": "weblogic2021", "trust": 0.1, "url": "https://github.com/somatrasss/weblogic2021 " }, { "title": "cubed", "trust": 0.1, "url": "https://github.com/yahoo/cubed " }, { "title": "", "trust": 0.1, "url": "https://github.com/cvedb/poc-list " }, { "title": "PoC-in-GitHub", "trust": 0.1, "url": "https://github.com/developer3000s/poc-in-github " } ], "sources": [ { "db": "VULMON", "id": "CVE-2019-17195" }, { "db": "JVNDB", "id": "JVNDB-2019-010680" }, { "db": "CNNVD", "id": "CNNVD-201910-914" } ] }, "problemtype_data": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/problemtype_data#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "problemtype": "CWE-755", "trust": 1.1 }, { "problemtype": "CWE-754", "trust": 0.9 } ], "sources": [ { "db": "VULHUB", "id": "VHN-149417" }, { "db": "JVNDB", "id": "JVNDB-2019-010680" }, { "db": "NVD", "id": "CVE-2019-17195" } ] }, "references": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/references#", "data": { "@container": "@list" }, "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": [ { "trust": 2.4, "url": "https://www.oracle.com/security-alerts/cpuapr2021.html" }, { "trust": 2.4, "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "trust": 2.4, "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "trust": 2.4, "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "trust": 1.8, "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/security-changelog.txt" }, { "trust": 1.8, "url": "https://connect2id.com/blog/nimbus-jose-jwt-7-9" }, { "trust": 1.8, "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "trust": 1.8, "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "trust": 1.8, "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "trust": 1.6, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-17195" }, { "trust": 1.0, "url": "https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d%40%3ccommon-dev.hadoop.apache.org%3e" }, { "trust": 1.0, "url": "https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41%40%3ccommon-issues.hadoop.apache.org%3e" }, { "trust": 1.0, "url": "https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2%40%3ccommits.druid.apache.org%3e" }, { "trust": 1.0, "url": "https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b%40%3ccommits.druid.apache.org%3e" }, { "trust": 1.0, "url": "https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a%40%3cdev.avro.apache.org%3e" }, { "trust": 1.0, "url": "https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d%40%3ccommits.druid.apache.org%3e" }, { "trust": 1.0, "url": "https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98%40%3cdev.avro.apache.org%3e" }, { "trust": 0.8, "url": "https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98@%3cdev.avro.apache.org%3e" }, { "trust": 0.8, "url": "https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a@%3cdev.avro.apache.org%3e" }, { "trust": 0.8, "url": "https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b@%3ccommits.druid.apache.org%3e" }, { "trust": 0.8, "url": "https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2@%3ccommits.druid.apache.org%3e" }, { "trust": 0.8, "url": "https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d@%3ccommits.druid.apache.org%3e" }, { "trust": 0.8, "url": "https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d@%3ccommon-dev.hadoop.apache.org%3e" }, { "trust": 0.8, "url": "https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41@%3ccommon-issues.hadoop.apache.org%3e" }, { "trust": 0.8, "url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-17195" }, { "trust": 0.7, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-qradar-siem-is-vulnerable-to-using-components-with-known-vulnerabilities-8/" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2021041363" }, { "trust": 0.6, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-dependent-libraries-affect-ibm-db2-leading-to-denial-of-service-or-privilege-escalation-3/" }, { "trust": 0.6, "url": "https://vigilance.fr/vulnerability/connect2id-nimbus-jose-jwt-privilege-escalation-via-jwt-parsing-31843" }, { "trust": 0.6, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-dependent-libraries-affect-ibm-db2-leading-to-denial-of-service-or-privilege-escalation/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.1427/" }, { "trust": 0.6, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilites-affect-ibm-jazz-foundation-and-ibm-engineering-products-5/" }, { "trust": 0.6, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilites-affect-ibm-jazz-foundation-and-ibm-engineering-products-3/" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2021072766" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/158750/red-hat-security-advisory-2020-3247-01.html" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2021072145" }, { "trust": 0.6, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-db2-warehouse-has-released-a-fix-in-response-to-multiple-vulnerabilities-found-in-ibm-db2/" }, { "trust": 0.6, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-have-been-identified-in-db2-that-affect-the-ibm-performance-management-product/" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2022042539" }, { "trust": 0.6, "url": "https://www.oracle.com/security-alerts/cpujul2021.html" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2022072128" }, { "trust": 0.6, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-multiple-vulnerabilities-in-dependent-libraries-affect-ibm-db2-leading-to-denial-of-service-or-privilege-escalation-2/" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2021.1519" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.2694/" }, { "trust": 0.6, "url": "https://www.cybersecurity-help.cz/vdb/sb2021042519" }, { "trust": 0.6, "url": "https://www.auscert.org.au/bulletins/esb-2020.1193/" }, { "trust": 0.6, "url": "https://packetstormsecurity.com/files/157073/red-hat-security-advisory-2020-1308-01.html" }, { "trust": 0.6, "url": "https://www.ibm.com/blogs/psirt/security-bulletin-ibm-security-guardium-is-affected-by-multiple-vulnerabilities-3/" }, { "trust": 0.2, "url": "https://access.redhat.com/errata/rhsa-2020:1308" }, { "trust": 0.2, "url": "https://access.redhat.com/articles/2974891" }, { "trust": 0.2, "url": "https://www.redhat.com/mailman/listinfo/rhsa-announce" }, { "trust": 0.2, "url": "https://bugzilla.redhat.com/):" }, { "trust": 0.2, "url": "https://access.redhat.com/security/team/key/" }, { "trust": 0.2, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-10086" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-17195" }, { "trust": 0.2, "url": "https://access.redhat.com/security/team/contact/" }, { "trust": 0.2, "url": "https://access.redhat.com/security/cve/cve-2019-10086" }, { "trust": 0.1, "url": "https://cwe.mitre.org/data/definitions/755.html" }, { "trust": 0.1, "url": "https://nvd.nist.gov" }, { "trust": 0.1, "url": "https://github.com/somatrasss/weblogic2021" }, { "trust": 0.1, "url": "https://access.redhat.com/security/updates/classification/#low" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11023" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-13990" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-7598" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-8331" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-10775" }, { "trust": 0.1, "url": "https://access.redhat.com/security/updates/classification/#important" }, { "trust": 0.1, "url": "https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html-single/technical_notes" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2017-18635" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-7598" }, { "trust": 0.1, "url": "https://access.redhat.com/errata/rhsa-2020:3247" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-11023" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2019-19336" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2020-11022" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-13990" }, { "trust": 0.1, "url": "https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/ht" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2017-18635" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-11022" }, { "trust": 0.1, "url": "https://access.redhat.com/security/cve/cve-2020-10775" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-8331" }, { "trust": 0.1, "url": "https://nvd.nist.gov/vuln/detail/cve-2019-19336" } ], "sources": [ { "db": "VULHUB", "id": "VHN-149417" }, { "db": "VULMON", "id": "CVE-2019-17195" }, { "db": "JVNDB", "id": "JVNDB-2019-010680" }, { "db": "PACKETSTORM", "id": "157073" }, { "db": "PACKETSTORM", "id": "158750" }, { "db": "NVD", "id": "CVE-2019-17195" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "CNNVD", "id": "CNNVD-201910-914" } ] }, "sources": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#", "data": { "@container": "@list" } }, "data": [ { "db": "VULHUB", "id": "VHN-149417" }, { "db": "VULMON", "id": "CVE-2019-17195" }, { "db": "JVNDB", "id": "JVNDB-2019-010680" }, { "db": "PACKETSTORM", "id": "157073" }, { "db": "PACKETSTORM", "id": "158750" }, { "db": "NVD", "id": "CVE-2019-17195" }, { "db": "CNNVD", "id": "CNNVD-202104-975" }, { "db": "CNNVD", "id": "CNNVD-201910-914" } ] }, "sources_release_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_release_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2019-10-15T00:00:00", "db": "VULHUB", "id": "VHN-149417" }, { "date": "2019-10-15T00:00:00", "db": "VULMON", "id": "CVE-2019-17195" }, { "date": "2019-10-21T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-010680" }, { "date": "2020-04-03T02:50:51", "db": "PACKETSTORM", "id": "157073" }, { "date": "2020-08-04T14:26:33", "db": "PACKETSTORM", "id": "158750" }, { "date": "2019-10-15T14:15:12.380000", "db": "NVD", "id": "CVE-2019-17195" }, { "date": "2021-04-13T00:00:00", "db": "CNNVD", "id": "CNNVD-202104-975" }, { "date": "2019-10-15T00:00:00", "db": "CNNVD", "id": "CNNVD-201910-914" } ] }, "sources_update_date": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources_update_date#", "data": { "@container": "@list" } }, "data": [ { "date": "2021-11-18T00:00:00", "db": "VULHUB", "id": "VHN-149417" }, { "date": "2022-06-07T00:00:00", "db": "VULMON", "id": "CVE-2019-17195" }, { "date": "2019-10-21T00:00:00", "db": "JVNDB", "id": "JVNDB-2019-010680" }, { "date": "2023-11-07T03:06:11.280000", "db": "NVD", "id": "CVE-2019-17195" }, { "date": "2021-04-14T00:00:00", "db": "CNNVD", "id": "CNNVD-202104-975" }, { "date": "2022-07-22T00:00:00", "db": "CNNVD", "id": "CNNVD-201910-914" } ] }, "threat_type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/threat_type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "remote", "sources": [ { "db": "CNNVD", "id": "CNNVD-201910-914" } ], "trust": 0.6 }, "title": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/title#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "Connect2id Nimbus JOSE+JWT Vulnerabilities related to exceptional state checking", "sources": [ { "db": "JVNDB", "id": "JVNDB-2019-010680" } ], "trust": 0.8 }, "type": { "@context": { "@vocab": "https://www.variotdbs.pl/ref/type#", "sources": { "@container": "@list", "@context": { "@vocab": "https://www.variotdbs.pl/ref/sources#" } } }, "data": "other", "sources": [ { "db": "CNNVD", "id": "CNNVD-202104-975" } ], "trust": 0.6 } }
ghsa-f6vf-pq8c-69m4
Vulnerability from github
Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.
{ "affected": [ { "package": { "ecosystem": "Maven", "name": "com.nimbusds:nimbus-jose-jwt" }, "ranges": [ { "events": [ { "introduced": "0" }, { "fixed": "7.9" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2019-17195" ], "database_specific": { "cwe_ids": [ "CWE-754", "CWE-755" ], "github_reviewed": true, "github_reviewed_at": "2019-10-16T15:26:53Z", "nvd_published_at": "2019-10-15T14:15:00Z", "severity": "CRITICAL" }, "details": "Connect2id Nimbus JOSE+JWT before v7.9 can throw various uncaught exceptions while parsing a JWT, which could result in an application crash (potential information disclosure) or a potential authentication bypass.", "id": "GHSA-f6vf-pq8c-69m4", "modified": "2022-02-08T22:07:38Z", "published": "2019-10-16T18:31:17Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17195" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpujan2021.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2022.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuapr2020.html" }, { "type": "WEB", "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "type": "WEB", "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/rcac26c2d4df22341fa6ebbfe93ba1eff77d2dcd3f6106a1dc1f9ac98@%3Cdev.avro.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r5e08837e695efd36be73510ce58ec05785dbcea077819d8acc2d990d@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r35f6301a3e6a56259224786dd9c2a935ba27ff6b494d15a3b66efe6a@%3Cdev.avro.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r33dc233634aedb04fa77db3eb79ea12d15ca4da89fa46a1c585ecb0b@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/r2667286c8ceffaf893b16829b9612d8f7c4ee6b30362c6c1b583e3c2@%3Ccommits.druid.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/e10d43984f39327e443e875adcd4a5049193a7c010e81971908caf41@%3Ccommon-issues.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://lists.apache.org/thread.html/8768553cda5838f59ee3865cac546e824fa740e82d9dc2a7fc44e80d@%3Ccommon-dev.hadoop.apache.org%3E" }, { "type": "WEB", "url": "https://connect2id.com/blog/nimbus-jose-jwt-7-9" }, { "type": "WEB", "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt/src/master/SECURITY-CHANGELOG.txt" }, { "type": "PACKAGE", "url": "https://bitbucket.org/connect2id/nimbus-jose-jwt" } ], "schema_version": "1.4.0", "severity": [ { "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "type": "CVSS_V3" } ], "summary": "Improper Check for Unusual or Exceptional Conditions in Connect2id Nimbus JOSE+JWT" }
rhsa-2020_1308
Vulnerability from csaf_redhat
Notes
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Low" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "An update is now available for Red Hat Virtualization Engine 4.3.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.", "title": "Topic" }, { "category": "general", "text": "The org.ovirt.engine-root is a core component of oVirt.\n\nThe following packages have been upgraded to a later upstream version: org.ovirt.engine-root (4.3.8.2), ovirt-engine-dwh (4.3.8), ovirt-engine-metrics (1.3.6.1), ovirt-fast-forward-upgrade (1.0.0), ovirt-imageio-common (1.5.3), ovirt-imageio-proxy (1.5.3), ovirt-web-ui (1.6.0), rhv-log-collector-analyzer (0.2.15), v2v-conversion-host (1.16.0). (BZ#1767333, BZ#1776722, BZ#1779587, BZ#1779631)\n\nSecurity Fix(es):\n\n* CVE-2019-17195\n* CVE-2019-10086\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* [downstream clone - 4.4.0] Upgrade from 4.3 to 4.4 will fail if there are versioned templates in database (BZ#1688781)\n\n* [ovirt-fast-forward-upgrade] Error: ovirt-engine-setup-plugin-ovirt-engine conflicts with ovirt-engine-4.2.5.2-0.1.el7ev.noarch (BZ#1754979)\n\n* Users immediately logged out from User portal due to negative UserSessionTimeOutInterval (BZ#1757423)\n\n* Fluentd error when stopping metrics services through playbook on 4.3 (BZ#1772506)\n\n* [downstream clone - 4.3.8] From VM Portal, users cannot create Operating System Windows VM. (BZ#1773580)\n\n* MERGE_STATUS fails with \u0027Invalid UUID string: mapper\u0027 when Direct LUN that already exists is hot-plugged [RHV clone - 4.3.8] (BZ#1779664)\n\n* Metric Store reports all hosts in Default cluster regardless of cluster assignment. (BZ#1780234)\n\nEnhancement(s):\n\n* RFE for offline installation of RHV Metrics Store (BZ#1711873)\n\n* [RFE] Compare storage with database for discrepancies (BZ#1739106)\n\n* [RFE] RHV+Metrics Store - Support a Flat DNS environment without subdomains (BZ#1782412)", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2020:1308", "url": "https://access.redhat.com/errata/RHSA-2020:1308" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#low", "url": "https://access.redhat.com/security/updates/classification/#low" }, { "category": "external", "summary": "1752522", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1752522" }, { "category": "external", "summary": "1764791", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764791" }, { "category": "external", "summary": "1767483", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1767483" }, { "category": "external", "summary": "1789737", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1789737" }, { "category": "external", "summary": "1792874", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1792874" }, { "category": "external", "summary": "1797496", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1797496" }, { "category": "external", "summary": "1801310", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1801310" }, { "category": "external", "summary": "1808038", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1808038" }, { "category": "external", "summary": "1808607", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1808607" }, { "category": "external", "summary": "1809470", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1809470" }, { "category": "external", "summary": "1810527", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1810527" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2020/rhsa-2020_1308.json" } ], "title": "Red Hat Security Advisory: Red Hat Virtualization Engine security, bug fix 4.3.9", "tracking": { "current_release_date": "2024-11-05T22:02:25+00:00", "generator": { "date": "2024-11-05T22:02:25+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2020:1308", "initial_release_date": "2020-04-02T16:33:32+00:00", "revision_history": [ { "date": "2020-04-02T16:33:32+00:00", "number": "1", "summary": "Initial version" }, { "date": "2020-04-02T16:33:32+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T22:02:25+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "RHV-M 4.3", "product": { "name": "RHV-M 4.3", "product_id": "7Server-RHV-S-4.3", "product_identification_helper": { "cpe": "cpe:/a:redhat:rhev_manager:4.3" } } }, { "category": "product_name", "name": "Tools for RHV Engine", "product": { "name": "Tools for RHV Engine", "product_id": "7Server-RHV-4-Tools-7", "product_identification_helper": { "cpe": "cpe:/o:redhat:enterprise_linux:7::hypervisor" } } } ], "category": "product_family", "name": "Red Hat Virtualization" }, { "branches": [ { "category": "product_version", "name": "ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch", "product": { "name": "ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch", "product_id": "ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-misc@1.0.4-1.el7ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch", "product": { "name": "ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch", "product_id": "ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-fast-forward-upgrade@1.0.0-17.el7ev?arch=noarch" } } }, { "category": "product_version", "name": "rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "product": { "name": "rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "product_id": "rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-dependencies@4.3.2-1.el7ev?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-backend@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-dbscripts@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extensions-api-impl@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extensions-api-impl-javadoc@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-health-check-bundler@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-restapi@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-base@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-cinderlib@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-ovirt-engine@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-ovirt-engine-common@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-vmconsole-proxy-helper@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-setup-plugin-websocket-proxy@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-tools@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-tools-backup@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-vmconsole-proxy-helper@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-webadmin-portal@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "product_id": "ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-websocket-proxy@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "product_id": "python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/python2-ovirt-engine-lib@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "rhvm-0:4.3.9.3-0.1.el7.noarch", "product": { "name": "rhvm-0:4.3.9.3-0.1.el7.noarch", "product_id": "rhvm-0:4.3.9.3-0.1.el7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm@4.3.9.3-0.1.el7?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "product": { "name": "apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "product_id": "apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-beanutils@1.8.3-15.el7_7?arch=noarch" } } }, { "category": "product_version", "name": "apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "product": { "name": "apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "product_id": "apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-beanutils-javadoc@1.8.3-15.el7_7?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src", "product": { "name": "ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src", "product_id": "ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine-extension-aaa-misc@1.0.4-1.el7ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src", "product": { "name": "ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src", "product_id": "ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-fast-forward-upgrade@1.0.0-17.el7ev?arch=src" } } }, { "category": "product_version", "name": "rhvm-dependencies-0:4.3.2-1.el7ev.src", "product": { "name": "rhvm-dependencies-0:4.3.2-1.el7ev.src", "product_id": "rhvm-dependencies-0:4.3.2-1.el7ev.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rhvm-dependencies@4.3.2-1.el7ev?arch=src" } } }, { "category": "product_version", "name": "ovirt-engine-0:4.3.9.3-0.1.el7.src", "product": { "name": "ovirt-engine-0:4.3.9.3-0.1.el7.src", "product_id": "ovirt-engine-0:4.3.9.3-0.1.el7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ovirt-engine@4.3.9.3-0.1.el7?arch=src" } } }, { "category": "product_version", "name": "apache-commons-beanutils-0:1.8.3-15.el7_7.src", "product": { "name": "apache-commons-beanutils-0:1.8.3-15.el7_7.src", "product_id": "apache-commons-beanutils-0:1.8.3-15.el7_7.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/apache-commons-beanutils@1.8.3-15.el7_7?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "apache-commons-beanutils-0:1.8.3-15.el7_7.noarch as a component of Tools for RHV Engine", "product_id": "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.noarch" }, "product_reference": "apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "relates_to_product_reference": "7Server-RHV-4-Tools-7" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-beanutils-0:1.8.3-15.el7_7.src as a component of Tools for RHV Engine", "product_id": "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.src" }, "product_reference": "apache-commons-beanutils-0:1.8.3-15.el7_7.src", "relates_to_product_reference": "7Server-RHV-4-Tools-7" }, { "category": "default_component_of", "full_product_name": { "name": "apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch as a component of Tools for RHV Engine", "product_id": "7Server-RHV-4-Tools-7:apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch" }, "product_reference": "apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "relates_to_product_reference": "7Server-RHV-4-Tools-7" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-0:4.3.9.3-0.1.el7.src as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.src" }, "product_reference": "ovirt-engine-0:4.3.9.3-0.1.el7.src", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch" }, "product_reference": "ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src" }, "product_reference": "ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch" }, "product_reference": "ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src" }, "product_reference": "ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-0:4.3.9.3-0.1.el7.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:rhvm-0:4.3.9.3-0.1.el7.noarch" }, "product_reference": "rhvm-0:4.3.9.3-0.1.el7.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-dependencies-0:4.3.2-1.el7ev.noarch as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.noarch" }, "product_reference": "rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "relates_to_product_reference": "7Server-RHV-S-4.3" }, { "category": "default_component_of", "full_product_name": { "name": "rhvm-dependencies-0:4.3.2-1.el7ev.src as a component of RHV-M 4.3", "product_id": "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.src" }, "product_reference": "rhvm-dependencies-0:4.3.2-1.el7ev.src", "relates_to_product_reference": "7Server-RHV-S-4.3" } ] }, "vulnerabilities": [ { "cve": "CVE-2019-10086", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2019-10-31T00:00:00+00:00", "flags": [ { "label": "vulnerable_code_not_present", "product_ids": [ "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src" ] } ], "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1767483" } ], "notes": [ { "category": "description", "text": "A flaw was found in the Apache Commons BeanUtils, where the class property in PropertyUtilsBean is not suppressed by default. This flaw allows an attacker to access the classloader.", "title": "Vulnerability description" }, { "category": "summary", "text": "apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.src", "7Server-RHV-4-Tools-7:apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.src", "7Server-RHV-S-4.3:ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.src" ], "known_not_affected": [ "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-10086" }, { "category": "external", "summary": "RHBZ#1767483", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1767483" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-10086", "url": "https://www.cve.org/CVERecord?id=CVE-2019-10086" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-10086", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-10086" }, { "category": "external", "summary": "https://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.4/RELEASE-NOTES.txt", "url": "https://commons.apache.org/proper/commons-beanutils/javadocs/v1.9.4/RELEASE-NOTES.txt" } ], "release_date": "2019-08-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-02T16:33:32+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.src", "7Server-RHV-4-Tools-7:apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.src", "7Server-RHV-S-4.3:ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1308" }, { "category": "workaround", "details": "There is no currently known mitigation for this flaw.", "product_ids": [ "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.src", "7Server-RHV-4-Tools-7:apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.src", "7Server-RHV-S-4.3:ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src", "7Server-RHV-S-4.3:python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.src" ] } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 7.3, "baseSeverity": "HIGH", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L", "version": "3.0" }, "products": [ "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.src", "7Server-RHV-4-Tools-7:apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.src", "7Server-RHV-S-4.3:ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.src" ] } ], "threats": [ { "category": "impact", "details": "Important" } ], "title": "apache-commons-beanutils: does not suppresses the class property in PropertyUtilsBean by default" }, { "cve": "CVE-2019-17195", "cwe": { "id": "CWE-248", "name": "Uncaught Exception" }, "discovery_date": "2019-10-15T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1764791" } ], "notes": [ { "category": "description", "text": "A flaw was found in Connect2id Nimbus JOSE+JWT prior to version 7.9. While processing JSON web tokens (JWT), nimbus-jose-jwt can throw various uncaught exceptions resulting in an application crash, information disclosure, or authentication bypass. The highest threat from this vulnerability is to data confidentiality and system availability.", "title": "Vulnerability description" }, { "category": "summary", "text": "nimbus-jose-jwt: Uncaught exceptions while parsing a JWT", "title": "Vulnerability summary" }, { "category": "other", "text": "In Red Hat Virtualization 4.2, nimbus-jose-jwt was bundled in the rhvm-dependencies package. In Red Hat Virtualization 4.3, nimbus-jose-jwt was made available as a separate package and no longer bundled in rhvm-dependencies. Thus, rhvm-dependencies only contained this vulnerability in the 4.2 EUS stream, the 4.3 version of rhvm-dependencies is not affected.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.src", "7Server-RHV-4-Tools-7:apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.src", "7Server-RHV-S-4.3:ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src", "7Server-RHV-S-4.3:python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2019-17195" }, { "category": "external", "summary": "RHBZ#1764791", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1764791" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2019-17195", "url": "https://www.cve.org/CVERecord?id=CVE-2019-17195" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-17195", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17195" } ], "release_date": "2019-10-15T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2020-04-02T16:33:32+00:00", "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891", "product_ids": [ "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.src", "7Server-RHV-4-Tools-7:apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.src", "7Server-RHV-S-4.3:ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src", "7Server-RHV-S-4.3:python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2020:1308" } ], "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "LOW", "baseScore": 6.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L", "version": "3.0" }, "products": [ "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.noarch", "7Server-RHV-4-Tools-7:apache-commons-beanutils-0:1.8.3-15.el7_7.src", "7Server-RHV-4-Tools-7:apache-commons-beanutils-javadoc-0:1.8.3-15.el7_7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-0:4.3.9.3-0.1.el7.src", "7Server-RHV-S-4.3:ovirt-engine-backend-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-dbscripts-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-engine-extension-aaa-misc-0:1.0.4-1.el7ev.src", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-extensions-api-impl-javadoc-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-health-check-bundler-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-restapi-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-base-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-cinderlib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-ovirt-engine-common-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-setup-plugin-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-tools-backup-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-vmconsole-proxy-helper-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-webadmin-portal-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-engine-websocket-proxy-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.noarch", "7Server-RHV-S-4.3:ovirt-fast-forward-upgrade-0:1.0.0-17.el7ev.src", "7Server-RHV-S-4.3:python2-ovirt-engine-lib-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-0:4.3.9.3-0.1.el7.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.noarch", "7Server-RHV-S-4.3:rhvm-dependencies-0:4.3.2-1.el7ev.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "nimbus-jose-jwt: Uncaught exceptions while parsing a JWT" } ] }
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.