rhsa-2015_0158
Vulnerability from csaf_redhat
Published
2015-02-11 17:38
Modified
2024-11-05 18:46
Summary
Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.5.0
Notes
Topic
Red Hat Enterprise Virtualization Manager 3.5.0 is now available.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details
Red Hat Enterprise Virtualization Manager is a visual tool for centrally
managing collections of virtual servers running Red Hat Enterprise Linux
and Microsoft Windows. This package also includes the Red Hat Enterprise
Virtualization Manager API, a set of scriptable commands that give
administrators the ability to perform queries and operations on Red Hat
Enterprise Virtualization Manager.
The Manager is a JBoss Application Server application that provides several
interfaces through which the virtual environment can be accessed and
interacted with, including an Administration Portal, a User Portal, and a
Representational State Transfer (REST) Application Programming Interface
(API).
It was discovered that the HttpClient incorrectly extracted the host name
from an X.509 certificate subject's Common Name (CN) field.
A man-in-the-middle attacker could use this flaw to spoof an SSL server
using a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)
A Cross-Site Request Forgery (CSRF) flaw was found in the oVirt REST API.
A remote attacker could provide a specially crafted web page that, when
visited by a user with a valid REST API session, would allow the attacker
to trigger calls to the oVirt REST API. (CVE-2014-0151)
It was found that the oVirt web admin interface did not include the
HttpOnly flag when setting session IDs with the Set-Cookie header.
This flaw could make it is easier for a remote attacker to hijack an oVirt
web admin session by leveraging a cross-site scripting (XSS) vulnerability.
(CVE-2014-0154)
The CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat
Product Security.
These updated Red Hat Enterprise Virtualization Manager packages also
include numerous bug fixes and various enhancements. Space precludes
documenting all of these changes in this advisory. Users are directed to
the Red Hat Enterprise Virtualization 3.5 Manager Release Notes document,
linked to in the References, for information on the most significant of
these changes.
All Red Hat Enterprise Virtualization Manager users are advised to upgrade
to these updated packages, which resolve these issues and add these
enhancements.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Enterprise Virtualization Manager 3.5.0 is now available.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Enterprise Virtualization Manager is a visual tool for centrally\nmanaging collections of virtual servers running Red Hat Enterprise Linux\nand Microsoft Windows. This package also includes the Red Hat Enterprise\nVirtualization Manager API, a set of scriptable commands that give\nadministrators the ability to perform queries and operations on Red Hat\nEnterprise Virtualization Manager.\n\nThe Manager is a JBoss Application Server application that provides several\ninterfaces through which the virtual environment can be accessed and\ninteracted with, including an Administration Portal, a User Portal, and a\nRepresentational State Transfer (REST) Application Programming Interface\n(API).\n\nIt was discovered that the HttpClient incorrectly extracted the host name\nfrom an X.509 certificate subject\u0027s Common Name (CN) field.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nA Cross-Site Request Forgery (CSRF) flaw was found in the oVirt REST API.\nA remote attacker could provide a specially crafted web page that, when\nvisited by a user with a valid REST API session, would allow the attacker\nto trigger calls to the oVirt REST API. (CVE-2014-0151)\n\nIt was found that the oVirt web admin interface did not include the\nHttpOnly flag when setting session IDs with the Set-Cookie header.\nThis flaw could make it is easier for a remote attacker to hijack an oVirt\nweb admin session by leveraging a cross-site scripting (XSS) vulnerability.\n(CVE-2014-0154)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nThese updated Red Hat Enterprise Virtualization Manager packages also\ninclude numerous bug fixes and various enhancements. Space precludes\ndocumenting all of these changes in this advisory. Users are directed to\nthe Red Hat Enterprise Virtualization 3.5 Manager Release Notes document,\nlinked to in the References, for information on the most significant of\nthese changes.\n\nAll Red Hat Enterprise Virtualization Manager users are advised to upgrade\nto these updated packages, which resolve these issues and add these\nenhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0158",
"url": "https://access.redhat.com/errata/RHSA-2015:0158"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.5/html/Manager_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.5/html/Manager_Release_Notes/index.html"
},
{
"category": "external",
"summary": "570191",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=570191"
},
{
"category": "external",
"summary": "716511",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=716511"
},
{
"category": "external",
"summary": "723211",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=723211"
},
{
"category": "external",
"summary": "800155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=800155"
},
{
"category": "external",
"summary": "804530",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=804530"
},
{
"category": "external",
"summary": "817180",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=817180"
},
{
"category": "external",
"summary": "828591",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=828591"
},
{
"category": "external",
"summary": "832167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=832167"
},
{
"category": "external",
"summary": "859024",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=859024"
},
{
"category": "external",
"summary": "874328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=874328"
},
{
"category": "external",
"summary": "878662",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=878662"
},
{
"category": "external",
"summary": "879077",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=879077"
},
{
"category": "external",
"summary": "884653",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=884653"
},
{
"category": "external",
"summary": "890517",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=890517"
},
{
"category": "external",
"summary": "894027",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=894027"
},
{
"category": "external",
"summary": "894084",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=894084"
},
{
"category": "external",
"summary": "895222",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=895222"
},
{
"category": "external",
"summary": "902298",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=902298"
},
{
"category": "external",
"summary": "906243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=906243"
},
{
"category": "external",
"summary": "906938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=906938"
},
{
"category": "external",
"summary": "912057",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=912057"
},
{
"category": "external",
"summary": "918138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=918138"
},
{
"category": "external",
"summary": "920708",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=920708"
},
{
"category": "external",
"summary": "922377",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=922377"
},
{
"category": "external",
"summary": "928727",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=928727"
},
{
"category": "external",
"summary": "947965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=947965"
},
{
"category": "external",
"summary": "955235",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=955235"
},
{
"category": "external",
"summary": "961753",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=961753"
},
{
"category": "external",
"summary": "962220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=962220"
},
{
"category": "external",
"summary": "962880",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=962880"
},
{
"category": "external",
"summary": "967466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=967466"
},
{
"category": "external",
"summary": "977079",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=977079"
},
{
"category": "external",
"summary": "977306",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=977306"
},
{
"category": "external",
"summary": "985945",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=985945"
},
{
"category": "external",
"summary": "987295",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=987295"
},
{
"category": "external",
"summary": "987299",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=987299"
},
{
"category": "external",
"summary": "988392",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=988392"
},
{
"category": "external",
"summary": "988422",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=988422"
},
{
"category": "external",
"summary": "989546",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=989546"
},
{
"category": "external",
"summary": "996512",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=996512"
},
{
"category": "external",
"summary": "999975",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=999975"
},
{
"category": "external",
"summary": "1001419",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1001419"
},
{
"category": "external",
"summary": "1003785",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1003785"
},
{
"category": "external",
"summary": "1007133",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007133"
},
{
"category": "external",
"summary": "1008512",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1008512"
},
{
"category": "external",
"summary": "1013670",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1013670"
},
{
"category": "external",
"summary": "1014326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1014326"
},
{
"category": "external",
"summary": "1015186",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1015186"
},
{
"category": "external",
"summary": "1016916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1016916"
},
{
"category": "external",
"summary": "1022795",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1022795"
},
{
"category": "external",
"summary": "1025376",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1025376"
},
{
"category": "external",
"summary": "1025831",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1025831"
},
{
"category": "external",
"summary": "1028387",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1028387"
},
{
"category": "external",
"summary": "1029934",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1029934"
},
{
"category": "external",
"summary": "1032686",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1032686"
},
{
"category": "external",
"summary": "1034309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1034309"
},
{
"category": "external",
"summary": "1034885",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1034885"
},
{
"category": "external",
"summary": "1038632",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1038632"
},
{
"category": "external",
"summary": "1040952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1040952"
},
{
"category": "external",
"summary": "1043430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043430"
},
{
"category": "external",
"summary": "1043808",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043808"
},
{
"category": "external",
"summary": "1044033",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1044033"
},
{
"category": "external",
"summary": "1044042",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1044042"
},
{
"category": "external",
"summary": "1048019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1048019"
},
{
"category": "external",
"summary": "1052348",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052348"
},
{
"category": "external",
"summary": "1053884",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053884"
},
{
"category": "external",
"summary": "1058022",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1058022"
},
{
"category": "external",
"summary": "1059435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1059435"
},
{
"category": "external",
"summary": "1061156",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1061156"
},
{
"category": "external",
"summary": "1062435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062435"
},
{
"category": "external",
"summary": "1064273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1064273"
},
{
"category": "external",
"summary": "1064544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1064544"
},
{
"category": "external",
"summary": "1065753",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065753"
},
{
"category": "external",
"summary": "1067162",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1067162"
},
{
"category": "external",
"summary": "1070348",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1070348"
},
{
"category": "external",
"summary": "1070823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1070823"
},
{
"category": "external",
"summary": "1071217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1071217"
},
{
"category": "external",
"summary": "1076705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1076705"
},
{
"category": "external",
"summary": "1077284",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1077284"
},
{
"category": "external",
"summary": "1079583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1079583"
},
{
"category": "external",
"summary": "1080144",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1080144"
},
{
"category": "external",
"summary": "1081533",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1081533"
},
{
"category": "external",
"summary": "1081849",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1081849"
},
{
"category": "external",
"summary": "1081896",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1081896"
},
{
"category": "external",
"summary": "1082110",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1082110"
},
{
"category": "external",
"summary": "1082681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1082681"
},
{
"category": "external",
"summary": "1083760",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083760"
},
{
"category": "external",
"summary": "1083763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083763"
},
{
"category": "external",
"summary": "1083766",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083766"
},
{
"category": "external",
"summary": "1083769",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083769"
},
{
"category": "external",
"summary": "1083926",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083926"
},
{
"category": "external",
"summary": "1083998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083998"
},
{
"category": "external",
"summary": "1084120",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1084120"
},
{
"category": "external",
"summary": "1084611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1084611"
},
{
"category": "external",
"summary": "1085136",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1085136"
},
{
"category": "external",
"summary": "1085380",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1085380"
},
{
"category": "external",
"summary": "1087745",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1087745"
},
{
"category": "external",
"summary": "1087917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1087917"
},
{
"category": "external",
"summary": "1091692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091692"
},
{
"category": "external",
"summary": "1092609",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092609"
},
{
"category": "external",
"summary": "1092884",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092884"
},
{
"category": "external",
"summary": "1093393",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093393"
},
{
"category": "external",
"summary": "1093742",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093742"
},
{
"category": "external",
"summary": "1093784",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093784"
},
{
"category": "external",
"summary": "1093786",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093786"
},
{
"category": "external",
"summary": "1095240",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1095240"
},
{
"category": "external",
"summary": "1096662",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1096662"
},
{
"category": "external",
"summary": "1096971",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1096971"
},
{
"category": "external",
"summary": "1097256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1097256"
},
{
"category": "external",
"summary": "1097622",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1097622"
},
{
"category": "external",
"summary": "1098591",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1098591"
},
{
"category": "external",
"summary": "1098638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1098638"
},
{
"category": "external",
"summary": "1098791",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1098791"
},
{
"category": "external",
"summary": "1100194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1100194"
},
{
"category": "external",
"summary": "1100810",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1100810"
},
{
"category": "external",
"summary": "1101018",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1101018"
},
{
"category": "external",
"summary": "1101565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1101565"
},
{
"category": "external",
"summary": "1102018",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102018"
},
{
"category": "external",
"summary": "1103490",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103490"
},
{
"category": "external",
"summary": "1103676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103676"
},
{
"category": "external",
"summary": "1103707",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103707"
},
{
"category": "external",
"summary": "1103976",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103976"
},
{
"category": "external",
"summary": "1104030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1104030"
},
{
"category": "external",
"summary": "1104195",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1104195"
},
{
"category": "external",
"summary": "1104233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1104233"
},
{
"category": "external",
"summary": "1109326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109326"
},
{
"category": "external",
"summary": "1109721",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109721"
},
{
"category": "external",
"summary": "1110172",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1110172"
},
{
"category": "external",
"summary": "1110636",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1110636"
},
{
"category": "external",
"summary": "1111551",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1111551"
},
{
"category": "external",
"summary": "1112359",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112359"
},
{
"category": "external",
"summary": "1113499",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1113499"
},
{
"category": "external",
"summary": "1113937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1113937"
},
{
"category": "external",
"summary": "1114041",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114041"
},
{
"category": "external",
"summary": "1114241",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114241"
},
{
"category": "external",
"summary": "1114244",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114244"
},
{
"category": "external",
"summary": "1114253",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114253"
},
{
"category": "external",
"summary": "1114260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114260"
},
{
"category": "external",
"summary": "1114554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114554"
},
{
"category": "external",
"summary": "1115845",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1115845"
},
{
"category": "external",
"summary": "1115966",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1115966"
},
{
"category": "external",
"summary": "1116486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1116486"
},
{
"category": "external",
"summary": "1118191",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1118191"
},
{
"category": "external",
"summary": "1118818",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1118818"
},
{
"category": "external",
"summary": "1118847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1118847"
},
{
"category": "external",
"summary": "1118879",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1118879"
},
{
"category": "external",
"summary": "1119922",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1119922"
},
{
"category": "external",
"summary": "1120197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120197"
},
{
"category": "external",
"summary": "1120829",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120829"
},
{
"category": "external",
"summary": "1120858",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120858"
},
{
"category": "external",
"summary": "1121454",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1121454"
},
{
"category": "external",
"summary": "1123396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1123396"
},
{
"category": "external",
"summary": "1123754",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1123754"
},
{
"category": "external",
"summary": "1125834",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1125834"
},
{
"category": "external",
"summary": "1126839",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1126839"
},
{
"category": "external",
"summary": "1128949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1128949"
},
{
"category": "external",
"summary": "1129012",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129012"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129634"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1130076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1130076"
},
{
"category": "external",
"summary": "1131693",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131693"
},
{
"category": "external",
"summary": "1132078",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1132078"
},
{
"category": "external",
"summary": "1132191",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1132191"
},
{
"category": "external",
"summary": "1133938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1133938"
},
{
"category": "external",
"summary": "1134009",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1134009"
},
{
"category": "external",
"summary": "1136087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1136087"
},
{
"category": "external",
"summary": "1139866",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139866"
},
{
"category": "external",
"summary": "1140098",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1140098"
},
{
"category": "external",
"summary": "1140430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1140430"
},
{
"category": "external",
"summary": "1141693",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1141693"
},
{
"category": "external",
"summary": "1142233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1142233"
},
{
"category": "external",
"summary": "1148379",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148379"
},
{
"category": "external",
"summary": "1148623",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148623"
},
{
"category": "external",
"summary": "1149135",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1149135"
},
{
"category": "external",
"summary": "1149235",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1149235"
},
{
"category": "external",
"summary": "1153544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1153544"
},
{
"category": "external",
"summary": "1154607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1154607"
},
{
"category": "external",
"summary": "1154630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1154630"
},
{
"category": "external",
"summary": "1156577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1156577"
},
{
"category": "external",
"summary": "1157211",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157211"
},
{
"category": "external",
"summary": "1160889",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1160889"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0158.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.5.0",
"tracking": {
"current_release_date": "2024-11-05T18:46:18+00:00",
"generator": {
"date": "2024-11-05T18:46:18+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.1.1"
}
},
"id": "RHSA-2015:0158",
"initial_release_date": "2015-02-11T17:38:50+00:00",
"revision_history": [
{
"date": "2015-02-11T17:38:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-02-11T17:38:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-05T18:46:18+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEV-M 3.5",
"product": {
"name": "RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhev_manager:3"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-tools@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-websocket-proxy@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-restapi@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup-plugin-ovirt-engine-common@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup-plugin-websocket-proxy@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup-plugin-ovirt-engine@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-extensions-api-impl-javadoc@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-userportal@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-backend@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup-base@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-webadmin-portal@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-extensions-api-impl@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup-plugin-allinone@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-dbscripts@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-lib@3.5.0-0.29.el6ev?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rhevm-0:3.5.0-0.29.el6ev.src",
"product": {
"name": "rhevm-0:3.5.0-0.29.el6ev.src",
"product_id": "rhevm-0:3.5.0-0.29.el6ev.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm@3.5.0-0.29.el6ev?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-0:3.5.0-0.29.el6ev.src as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src"
},
"product_reference": "rhevm-0:3.5.0-0.29.el6ev.src",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-backend-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-lib-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-restapi-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-tools-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-userportal-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-11T17:38:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2014-0151",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2014-03-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1081849"
}
],
"notes": [
{
"category": "description",
"text": "A Cross-Site Request Forgery (CSRF) flaw was found in the oVirt REST API. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid REST API session, would allow the attacker to trigger calls to the oVirt REST API.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ovirt-engine: cross-site request forgery (CSRF)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0151"
},
{
"category": "external",
"summary": "RHBZ#1081849",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1081849"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0151",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0151"
}
],
"release_date": "2014-03-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-11T17:38:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ovirt-engine: cross-site request forgery (CSRF)"
},
{
"cve": "CVE-2014-0154",
"cwe": {
"id": "CWE-522",
"name": "Insufficiently Protected Credentials"
},
"discovery_date": "2014-03-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1081896"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the oVirt web admin interface did not include the HttpOnly flag when setting session IDs with the Set-Cookie header. This flaw could make it is easier for a remote attacker to hijack an oVirt web admin session by leveraging a cross-site scripting (XSS) vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ovirt-engine-webadmin: HttpOnly flag is not included when the session ID is set",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0154"
},
{
"category": "external",
"summary": "RHBZ#1081896",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1081896"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0154",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0154"
}
],
"release_date": "2014-03-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-11T17:38:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ovirt-engine-webadmin: HttpOnly flag is not included when the session ID is set"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-11T17:38:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
}
]
}
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.