rhsa-2012_0421
Vulnerability from csaf_redhat
Published
2012-03-26 15:16
Modified
2024-11-14 11:30
Summary
Red Hat Security Advisory: rhevm security and bug fix update

Notes

Topic
Updated rhevm packages that fix one security issue and various bugs are now available. The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.
Details
Red Hat Enterprise Virtualization Manager is a visual tool for centrally managing collections of virtual machines running Red Hat Enterprise Linux and Microsoft Windows. These packages also include the Red Hat Enterprise Virtualization Manager REST (Representational State Transfer) API, a set of scriptable commands that give administrators the ability to perform queries and operations on Red Hat Enterprise Virtualization Manager. It was found that RESTEasy was vulnerable to XML External Entity (XXE) attacks. If a remote attacker who is able to access the Red Hat Enterprise Virtualization Manager REST API submitted a request containing an external XML entity to a RESTEasy endpoint, the entity would be resolved, allowing the attacker to read files accessible to the user running the application server. This flaw affected DOM (Document Object Model) Document and JAXB (Java Architecture for XML Binding) input. (CVE-2012-0818) This update also fixes the following bugs: * Previously the REST API was ignoring the "Accept" header. This made it impossible to retrieve detailed information about specific sub-collections, including hosts and disks. The REST API has been updated and now processes the "Accept" header as originally intended. (BZ#771369) * The "start_time" Virtual Machine property was previously always set. This meant that even Virtual Machines that were stopped, had a value for "start_time". An update has been made to ensure that the "start_time" property is only set when the Virtual Machine has been started, and is running. (BZ#772975) * The 'rhevm-setup' script previously only ran successfully on systems with their locale set to 'en_US.UTF-8', 'en_US.utf-8', or 'en_US.utf8'. The script has since been updated to also run successfully in additional locales, including 'ja_JP.UTF-8'. (BZ#784860) * The REST API did not previously validate that all required parameters were provided when enabling power management. The response code returned would also incorrectly indicate the operation had succeeded where mandatory parameters were not supplied. An update has been made to ensure that the power management parameters are validated correctly. (BZ#785744) * Previously no warning or error was issued when the amount of free disk space on a host was low. When no free disk space remained on the host it would become non-responsive with no prior warning. An update has been made to report a warning in the audit log when a host's free disk space is less than 1000 MB, and an error when a host's free disk space is less than 500 MB. (BZ#786132) * When importing Virtual Machines no notification was provided if the MAC address of the network interface card clashed with that of an existing Virtual Machine. Now when this occurs a message is printed to the audit log, highlighting the need for manual intervention. (BZ#795416) * Previously it was not possible to set more, or less, than one value for SpiceSecureChannels using the rhevm-config tool. This meant it was not possible to encrypt all SPICE channels. The rhevm-config tool has been updated and it is now possible to encrypt all SPICE channels, by adding them to the SpiceSecureChannels configuration key. (BZ#784012) All Red Hat Enterprise Virtualization users are advised to upgrade to these updated packages, which address this vulnerability and fix these bugs. Refer to the Solution section for information about installing this update.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "Updated rhevm packages that fix one security issue and various bugs are now\navailable.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat Enterprise Virtualization Manager is a visual tool for centrally\nmanaging collections of virtual machines running Red Hat Enterprise Linux\nand Microsoft Windows. These packages also include the Red Hat Enterprise\nVirtualization Manager REST (Representational State Transfer) API, a set of\nscriptable commands that give administrators the ability to perform queries\nand operations on Red Hat Enterprise Virtualization Manager.\n\nIt was found that RESTEasy was vulnerable to XML External Entity (XXE)\nattacks. If a remote attacker who is able to access the Red Hat Enterprise\nVirtualization Manager REST API submitted a request containing an external\nXML entity to a RESTEasy endpoint, the entity would be resolved, allowing\nthe attacker to read files accessible to the user running the application\nserver. This flaw affected DOM (Document Object Model) Document and JAXB\n(Java Architecture for XML Binding) input. (CVE-2012-0818)\n\nThis update also fixes the following bugs:\n\n* Previously the REST API was ignoring the \"Accept\" header. This made it\nimpossible to retrieve detailed information about specific sub-collections,\nincluding hosts and disks. The REST API has been updated and now processes\nthe \"Accept\" header as originally intended. (BZ#771369)\n\n* The \"start_time\" Virtual Machine property was previously always set. This\nmeant that even Virtual Machines that were stopped, had a value for\n\"start_time\". An update has been made to ensure that the \"start_time\"\nproperty is only set when the Virtual Machine has been started, and is\nrunning. (BZ#772975)\n\n* The \u0027rhevm-setup\u0027 script previously only ran successfully on systems with\ntheir locale set to \u0027en_US.UTF-8\u0027, \u0027en_US.utf-8\u0027, or \u0027en_US.utf8\u0027. The\nscript has since been updated to also run successfully in additional\nlocales, including \u0027ja_JP.UTF-8\u0027. (BZ#784860)\n\n* The REST API did not previously validate that all required parameters\nwere provided when enabling power management. The response code returned\nwould also incorrectly indicate the operation had succeeded where\nmandatory parameters were not supplied. An update has been made to ensure\nthat the power management parameters are validated correctly. (BZ#785744)\n\n* Previously no warning or error was issued when the amount of free disk\nspace on a host was low. When no free disk space remained on the host it\nwould become non-responsive with no prior warning. An update has been made\nto report a warning in the audit log when a host\u0027s free disk space is less\nthan 1000 MB, and an error when a host\u0027s free disk space is less than 500\nMB. (BZ#786132)\n\n* When importing Virtual Machines no notification was provided if the MAC\naddress of the network interface card clashed with that of an existing\nVirtual Machine. Now when this occurs a message is printed to the audit\nlog, highlighting the need for manual intervention. (BZ#795416)\n\n* Previously it was not possible to set more, or less, than one value for\nSpiceSecureChannels using the rhevm-config tool. This meant it was not\npossible to encrypt all SPICE channels. The rhevm-config tool has been\nupdated and it is now possible to encrypt all SPICE channels, by adding\nthem to the SpiceSecureChannels configuration key. (BZ#784012)\n\nAll Red Hat Enterprise Virtualization users are advised to upgrade to these\nupdated packages, which address this vulnerability and fix these bugs.\nRefer to the Solution section for information about installing this update.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2012:0421",
        "url": "https://access.redhat.com/errata/RHSA-2012:0421"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html",
        "url": "http://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html"
      },
      {
        "category": "external",
        "summary": "785631",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2012/rhsa-2012_0421.json"
      }
    ],
    "title": "Red Hat Security Advisory: rhevm security and bug fix update",
    "tracking": {
      "current_release_date": "2024-11-14T11:30:41+00:00",
      "generator": {
        "date": "2024-11-14T11:30:41+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.0"
        }
      },
      "id": "RHSA-2012:0421",
      "initial_release_date": "2012-03-26T15:16:00+00:00",
      "revision_history": [
        {
          "date": "2012-03-26T15:16:00+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2012-03-26T15:17:18+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-14T11:30:41+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEV-M for Servers",
                "product": {
                  "name": "RHEV-M for Servers",
                  "product_id": "6Server-RHEV-S",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhev_manager:3"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-notification-service@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-log-collector@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-iso-uploader@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-genericapi@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-restapi@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-debuginfo@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-jboss-deps@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-webadmin-portal@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-backend@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-dbscripts@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-setup@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-config-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-config-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-config-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-config@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-userportal@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
                "product": {
                  "name": "rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
                  "product_id": "rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm-tools-common@3.0.3_0001-3.el6?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rhevm-0:3.0.3_0001-3.el6.src",
                "product": {
                  "name": "rhevm-0:3.0.3_0001-3.el6.src",
                  "product_id": "rhevm-0:3.0.3_0001-3.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rhevm@3.0.3_0001-3.el6?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-0:3.0.3_0001-3.el6.src as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src"
        },
        "product_reference": "rhevm-0:3.0.3_0001-3.el6.src",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-backend-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-config-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-config-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-restapi-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-setup-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-userportal-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64 as a component of RHEV-M for Servers",
          "product_id": "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64"
        },
        "product_reference": "rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64",
        "relates_to_product_reference": "6Server-RHEV-S"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2011-5245",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2012-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "785631"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "The readFrom function in providers.jaxb.JAXBXmlTypeProvider in RESTEasy before 2.3.2 allows remote attackers to read arbitrary files via an external entity reference in a Java Architecture for XML Binding (JAXB) input, aka an XML external entity (XXE) injection attack, a similar vulnerability to CVE-2012-0818.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RESTEasy: XML eXternal Entity (XXE) flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
          "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2011-5245"
        },
        {
          "category": "external",
          "summary": "RHBZ#785631",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2011-5245",
          "url": "https://www.cve.org/CVERecord?id=CVE-2011-5245"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2011-5245",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2011-5245"
        }
      ],
      "release_date": "2011-12-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-03-26T15:16:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Follow the upgrade\nprocedure in the Red Hat Enterprise Virtualization\nInstallation Guide to install these updated packages:\n\nhttp://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html",
          "product_ids": [
            "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
            "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:0421"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
            "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "RESTEasy: XML eXternal Entity (XXE) flaw"
    },
    {
      "cve": "CVE-2012-0818",
      "cwe": {
        "id": "CWE-611",
        "name": "Improper Restriction of XML External Entity Reference"
      },
      "discovery_date": "2012-01-24T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "785631"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "RESTEasy before 2.3.1 allows remote attackers to read arbitrary files via an external entity reference in a DOM document, aka an XML external entity (XXE) injection attack.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "RESTEasy: XML eXternal Entity (XXE) flaw",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
          "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
          "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2012-0818"
        },
        {
          "category": "external",
          "summary": "RHBZ#785631",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=785631"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2012-0818",
          "url": "https://www.cve.org/CVERecord?id=CVE-2012-0818"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-0818",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-0818"
        }
      ],
      "release_date": "2011-12-30T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2012-03-26T15:16:00+00:00",
          "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Follow the upgrade\nprocedure in the Red Hat Enterprise Virtualization\nInstallation Guide to install these updated packages:\n\nhttp://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Virtualization/3.0/html/Installation_Guide/chap-Installation_Guide-Installing_the_RHEV_Manager-Upgrades.html",
          "product_ids": [
            "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
            "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2012:0421"
        }
      ],
      "scores": [
        {
          "cvss_v2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "products": [
            "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.src",
            "6Server-RHEV-S:rhevm-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-backend-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-config-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-dbscripts-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-debuginfo-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-genericapi-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-iso-uploader-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-jboss-deps-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-log-collector-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-notification-service-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-restapi-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-setup-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-tools-common-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-userportal-0:3.0.3_0001-3.el6.x86_64",
            "6Server-RHEV-S:rhevm-webadmin-portal-0:3.0.3_0001-3.el6.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "RESTEasy: XML eXternal Entity (XXE) flaw"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.