csaf_redhat - rhsa-2021

rhsa-2021_2239

Vulnerability from csaf_redhat

Published

2021-06-03 10:26

Modified

2024-09-16 04:54

Summary

Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.4.6]

Notes

Topic

An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Details

The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Security Fix(es): * python-cryptography: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25659) * krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS (CVE-2020-28196) * python-cryptography: certain sequences of update() calls when symmetrically encrypting very large payloads could result in an integer overflow and lead to buffer overflows (CVE-2020-36242) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Previously, old RPM files were not properly removed during package removal (uninistall) or upgrade. As a result, removed packages were reinstalled, or, during and upgrade, the system tried to install two or more different versions at once, causing the upgrade to fail. In this release, the dnf plugin has been fixed, and RPM packages are now properly removed. The new version will also auto-heal the broken system by removing RPM packages which are not supposed to be in the persisted-rpms directory. (BZ#1936972) * With this release, ovirt-hosted-engine-ha supports multiple, comma-separated values for all iSCSI configuration items. (BZ#1909888)

This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_vex",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host\u0027s resources and performing administrative tasks.\n\nThe redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host\u0027s resources and performing administrative tasks. \n\nThe ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host\u0027s resources and performing administrative tasks.\n\nSecurity Fix(es):\n\n* python-cryptography: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25659)\n\n* krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS (CVE-2020-28196)\n\n* python-cryptography: certain sequences of update() calls when symmetrically encrypting very large payloads could result in an integer overflow and lead to buffer overflows (CVE-2020-36242)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Previously, old RPM files were not properly removed during package removal (uninistall) or upgrade. As a result, removed packages were reinstalled, or, during and upgrade, the system tried to install two or more different versions at once, causing the upgrade to fail.\nIn this release, the dnf plugin has been fixed, and RPM packages are now properly removed.\nThe new version will also auto-heal the broken system by removing RPM packages which are not supposed to be in the persisted-rpms directory. (BZ#1936972)\n\n* With this release, ovirt-hosted-engine-ha supports multiple, comma-separated values for all iSCSI configuration items. (BZ#1909888)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat offerings.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:2239",
        "url": "https://access.redhat.com/errata/RHSA-2021:2239"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1779052",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1779052"
      },
      {
        "category": "external",
        "summary": "1882542",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882542"
      },
      {
        "category": "external",
        "summary": "1889988",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889988"
      },
      {
        "category": "external",
        "summary": "1897893",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1897893"
      },
      {
        "category": "external",
        "summary": "1901041",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901041"
      },
      {
        "category": "external",
        "summary": "1901878",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901878"
      },
      {
        "category": "external",
        "summary": "1909888",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909888"
      },
      {
        "category": "external",
        "summary": "1926226",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926226"
      },
      {
        "category": "external",
        "summary": "1931443",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1931443"
      },
      {
        "category": "external",
        "summary": "1936972",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1936972"
      },
      {
        "category": "external",
        "summary": "1938925",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1938925"
      },
      {
        "category": "external",
        "summary": "1942580",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942580"
      },
      {
        "category": "external",
        "summary": "1944632",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1944632"
      },
      {
        "category": "external",
        "summary": "1946095",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1946095"
      },
      {
        "category": "external",
        "summary": "1948944",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1948944"
      },
      {
        "category": "external",
        "summary": "1949431",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1949431"
      },
      {
        "category": "external",
        "summary": "1957604",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1957604"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://access.redhat.com/security/data/csaf/v2/advisories/2021/rhsa-2021_2239.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.4.6]",
    "tracking": {
      "current_release_date": "2024-09-16T04:54:47+00:00",
      "generator": {
        "date": "2024-09-16T04:54:47+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "3.33.3"
        }
      },
      "id": "RHSA-2021:2239",
      "initial_release_date": "2021-06-03T10:26:34+00:00",
      "revision_history": [
        {
          "date": "2021-06-03T10:26:34+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-06-03T10:26:34+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-09-16T04:54:47+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
                "product": {
                  "name": "RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
                  "product_id": "8Base-RHV-HypervisorBuild-4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
                "product": {
                  "name": "Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
                  "product_id": "8Base-RHV-Agents-4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Virtualization 4 Hypervisor for RHEL 8",
                "product": {
                  "name": "Red Hat Virtualization 4 Hypervisor for RHEL 8",
                  "product_id": "8Base-RHV-Hypervisor-4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
                "product": {
                  "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
                  "product_id": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-release-virtualization-host@4.4.6-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "imgbased-0:1.2.19-1.el8ev.src",
                "product": {
                  "name": "imgbased-0:1.2.19-1.el8ev.src",
                  "product_id": "imgbased-0:1.2.19-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/imgbased@1.2.19-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "scap-security-guide-0:0.1.54-1.el8ev.src",
                "product": {
                  "name": "scap-security-guide-0:0.1.54-1.el8ev.src",
                  "product_id": "scap-security-guide-0:0.1.54-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/scap-security-guide@0.1.54-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
                "product": {
                  "name": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
                  "product_id": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-ovirt@0.15.0-2.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
                "product": {
                  "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
                  "product_id": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-hosted-engine-ha@2.4.7-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
                "product": {
                  "name": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
                  "product_id": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-virtualization-host@4.4.6-20210527.3.el8_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
                "product": {
                  "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
                  "product_id": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-release-virtualization-host@4.4.6-1.el8ev?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfod-client@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debugsource-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debugsource-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debugsource-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debugsource@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfod-client-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfod-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-libelf-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-libs-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
                "product": {
                  "name": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
                  "product_id": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-virtualization-host-image-update@4.4.6-20210527.3.el8_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
                "product": {
                  "name": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
                  "product_id": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-virtualization-host-image-update-placeholder@4.4.6-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "imgbased-0:1.2.19-1.el8ev.noarch",
                "product": {
                  "name": "imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_id": "imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/imgbased@1.2.19-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
                "product": {
                  "name": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_id": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-imgbased@1.2.19-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
                "product": {
                  "name": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
                  "product_id": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/scap-security-guide-rhv@0.1.54-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
                "product": {
                  "name": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
                  "product_id": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-ovirt-dashboard@0.15.0-2.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
                "product": {
                  "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
                  "product_id": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-hosted-engine-ha@2.4.7-1.el8ev?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ovirt-0:0.15.0-2.el8ev.src as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src"
        },
        "product_reference": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch"
        },
        "product_reference": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch"
        },
        "product_reference": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src"
        },
        "product_reference": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debugsource-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debugsource-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src"
        },
        "product_reference": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        },
        "product_reference": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "imgbased-0:1.2.19-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch"
        },
        "product_reference": "imgbased-0:1.2.19-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "imgbased-0:1.2.19-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src"
        },
        "product_reference": "imgbased-0:1.2.19-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-imgbased-0:1.2.19-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch"
        },
        "product_reference": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src"
        },
        "product_reference": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64"
        },
        "product_reference": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch"
        },
        "product_reference": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "scap-security-guide-0:0.1.54-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src"
        },
        "product_reference": "scap-security-guide-0:0.1.54-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        },
        "product_reference": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Hubert Kario"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2020-25659",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2020-10-21T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1889988"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-cryptography package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        ],
        "known_not_affected": [
          "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
          "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
          "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "RHBZ#1889988",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889988"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-25659",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25659",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "https://cryptography.io/en/latest/changelog.html#v3-2",
          "url": "https://cryptography.io/en/latest/changelog.html#v3-2"
        }
      ],
      "release_date": "2020-10-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2239"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption"
    },
    {
      "cve": "CVE-2020-28196",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2020-11-06T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1901041"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        ],
        "known_not_affected": [
          "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
          "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
          "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-28196"
        },
        {
          "category": "external",
          "summary": "RHBZ#1901041",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901041"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28196",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-28196"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28196",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28196"
        }
      ],
      "release_date": "2020-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2239"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS"
    },
    {
      "cve": "CVE-2020-36242",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2021-02-07T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1926226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer-overflow flaw was found in the python-cryptography package. In certain sequences of ``update()`` calls when symmetrically encrypting very large payloads (\u003e2GB) could result in an integer overflow, leading to buffer overflows. Note: This fix is a workaround for the OpenSSL CVE-2021-23840 flaw. Source: pyca/cryptography project",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Triggering this flaw on in versions of python-cryptography as shipped with Red Hat Enterprise Linux 8 BaseOS, Appstream, as well as Red Hat Software Collections, can result in denial of service due to memory consumption or MemoryError exception.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-cryptography package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        ],
        "known_not_affected": [
          "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
          "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
          "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "RHBZ#1926226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-36242",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-36242",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "https://cryptography.io/en/latest/changelog.html#v3-3-2",
          "url": "https://cryptography.io/en/latest/changelog.html#v3-3-2"
        }
      ],
      "release_date": "2020-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2239"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow"
    }
  ]
}

cve-2020-28196

Vulnerability from cvelistv5

Published

2020-11-06 07:07

Modified

2024-08-04 16:33

Severity

Summary

MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.

References

URL	Tags
https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html	mailing-list, x_refsource_MLIST
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/	vendor-advisory, x_refsource_FEDORA
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/	vendor-advisory, x_refsource_FEDORA
https://security.gentoo.org/glsa/202011-17	vendor-advisory, x_refsource_GENTOO
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/	vendor-advisory, x_refsource_FEDORA
https://www.debian.org/security/2020/dsa-4795	vendor-advisory, x_refsource_DEBIAN
https://www.oracle.com/security-alerts/cpuApr2021.html	x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210513-0002/	x_refsource_CONFIRM
https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd	x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-20201202-0001/	x_refsource_CONFIRM
https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E	mailing-list, x_refsource_MLIST
https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E	mailing-list, x_refsource_MLIST
https://www.oracle.com//security-alerts/cpujul2021.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC

Impacted products

Vendor	Product
n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:33:58.154Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "[debian-lts-announce] 20201107 [SECURITY] [DLA 2437-1] krb5 security update",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html"
          },
          {
            "name": "FEDORA-2020-32193cbbe6",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/"
          },
          {
            "name": "FEDORA-2020-27b577ab23",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/"
          },
          {
            "name": "GLSA-202011-17",
            "tags": [
              "vendor-advisory",
              "x_refsource_GENTOO",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202011-17"
          },
          {
            "name": "FEDORA-2020-0df38b2843",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/"
          },
          {
            "name": "DSA-4795",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2020/dsa-4795"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20201202-0001/"
          },
          {
            "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-19T23:22:37",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "name": "[debian-lts-announce] 20201107 [SECURITY] [DLA 2437-1] krb5 security update",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html"
        },
        {
          "name": "FEDORA-2020-32193cbbe6",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/"
        },
        {
          "name": "FEDORA-2020-27b577ab23",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/"
        },
        {
          "name": "GLSA-202011-17",
          "tags": [
            "vendor-advisory",
            "x_refsource_GENTOO"
          ],
          "url": "https://security.gentoo.org/glsa/202011-17"
        },
        {
          "name": "FEDORA-2020-0df38b2843",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/"
        },
        {
          "name": "DSA-4795",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2020/dsa-4795"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20201202-0001/"
        },
        {
          "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-28196",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "[debian-lts-announce] 20201107 [SECURITY] [DLA 2437-1] krb5 security update",
              "refsource": "MLIST",
              "url": "https://lists.debian.org/debian-lts-announce/2020/11/msg00011.html"
            },
            {
              "name": "FEDORA-2020-32193cbbe6",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/73IGOG6CZAVMVNS4GGRMOLOZ7B6QVA7F/"
            },
            {
              "name": "FEDORA-2020-27b577ab23",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KPH2V3WSQTELROZK3GFCPQDOFLKIZ6H5/"
            },
            {
              "name": "GLSA-202011-17",
              "refsource": "GENTOO",
              "url": "https://security.gentoo.org/glsa/202011-17"
            },
            {
              "name": "FEDORA-2020-0df38b2843",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/45KKOZQWIIIW5C45PJVGQ32AXBSYNBE7/"
            },
            {
              "name": "DSA-4795",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2020/dsa-4795"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuApr2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuApr2021.html"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210513-0002/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210513-0002/"
            },
            {
              "name": "https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd",
              "refsource": "CONFIRM",
              "url": "https://github.com/krb5/krb5/commit/57415dda6cf04e73ffc3723be518eddfae599bfd"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20201202-0001/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20201202-0001/"
            },
            {
              "name": "[bookkeeper-issues] 20210628 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "[bookkeeper-issues] 20210629 [GitHub] [bookkeeper] padma81 opened a new issue #2746: Security Vulnerabilities in CentOS 7 image, Upgrade image to CentOS 8",
              "refsource": "MLIST",
              "url": "https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"
            },
            {
              "name": "https://www.oracle.com//security-alerts/cpujul2021.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com//security-alerts/cpujul2021.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-28196",
    "datePublished": "2020-11-06T07:07:38",
    "dateReserved": "2020-11-03T00:00:00",
    "dateUpdated": "2024-08-04T16:33:58.154Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-25659

Vulnerability from cvelistv5

Published

2021-01-11 15:37

Modified

2024-08-04 15:40

Severity

Summary

python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

References

URL	Tags
https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b	x_refsource_MISC
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

Vendor	Product
n/a	python-cryptography

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T15:40:36.578Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "python-cryptography",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "python-cryptography 3.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-385",
              "description": "CWE-385",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:15:44",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2020-25659",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "python-cryptography",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "python-cryptography 3.2"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-385"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b",
              "refsource": "MISC",
              "url": "https://github.com/pyca/cryptography/pull/5507/commits/ce1bef6f1ee06ac497ca0c837fbd1c7ef6c2472b"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2020-25659",
    "datePublished": "2021-01-11T15:37:29",
    "dateReserved": "2020-09-16T00:00:00",
    "dateUpdated": "2024-08-04T15:40:36.578Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

cve-2020-36242

Vulnerability from cvelistv5

Published

2021-02-07 19:50

Modified

2024-08-04 17:23

Severity

Summary

In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

References

URL	Tags
https://github.com/pyca/cryptography/issues/5615	x_refsource_MISC
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/	vendor-advisory, x_refsource_FEDORA
https://www.oracle.com/security-alerts/cpuapr2022.html	x_refsource_MISC
https://github.com/pyca/cryptography/compare/3.3.1...3.3.2	x_refsource_CONFIRM
https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst	x_refsource_CONFIRM
https://www.oracle.com/security-alerts/cpujul2022.html	x_refsource_MISC

Impacted products

Vendor	Product
n/a	n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T17:23:09.814Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/pyca/cryptography/issues/5615"
          },
          {
            "name": "FEDORA-2021-8e36e7ed1a",
            "tags": [
              "vendor-advisory",
              "x_refsource_FEDORA",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/pyca/cryptography/compare/3.3.1...3.3.2"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-07-25T16:22:24",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/pyca/cryptography/issues/5615"
        },
        {
          "name": "FEDORA-2021-8e36e7ed1a",
          "tags": [
            "vendor-advisory",
            "x_refsource_FEDORA"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyca/cryptography/compare/3.3.1...3.3.2"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-36242",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://github.com/pyca/cryptography/issues/5615",
              "refsource": "MISC",
              "url": "https://github.com/pyca/cryptography/issues/5615"
            },
            {
              "name": "FEDORA-2021-8e36e7ed1a",
              "refsource": "FEDORA",
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/L7RGQLK4J5ZQFRLKCHVVG6BKZTUQMG7E/"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpuapr2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
            },
            {
              "name": "https://github.com/pyca/cryptography/compare/3.3.1...3.3.2",
              "refsource": "CONFIRM",
              "url": "https://github.com/pyca/cryptography/compare/3.3.1...3.3.2"
            },
            {
              "name": "https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst",
              "refsource": "CONFIRM",
              "url": "https://github.com/pyca/cryptography/blob/master/CHANGELOG.rst"
            },
            {
              "name": "https://www.oracle.com/security-alerts/cpujul2022.html",
              "refsource": "MISC",
              "url": "https://www.oracle.com/security-alerts/cpujul2022.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-36242",
    "datePublished": "2021-02-07T19:50:57",
    "dateReserved": "2021-02-07T00:00:00",
    "dateUpdated": "2024-08-04T17:23:09.814Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Action not permitted

rhsa-2021_2239

Vulnerability from csaf_redhat

cve-2020-28196

Vulnerability from cvelistv5

cve-2020-25659

Vulnerability from cvelistv5

cve-2020-36242

Vulnerability from cvelistv5

Tags