RHSA-2015:0158
Vulnerability from csaf_redhat - Published: 2015-02-11 17:38 - Updated: 2026-01-28 22:35Summary
Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.5.0
Severity
Important
Notes
Topic: Red Hat Enterprise Virtualization Manager 3.5.0 is now available.
Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.
Details: Red Hat Enterprise Virtualization Manager is a visual tool for centrally
managing collections of virtual servers running Red Hat Enterprise Linux
and Microsoft Windows. This package also includes the Red Hat Enterprise
Virtualization Manager API, a set of scriptable commands that give
administrators the ability to perform queries and operations on Red Hat
Enterprise Virtualization Manager.
The Manager is a JBoss Application Server application that provides several
interfaces through which the virtual environment can be accessed and
interacted with, including an Administration Portal, a User Portal, and a
Representational State Transfer (REST) Application Programming Interface
(API).
It was discovered that the HttpClient incorrectly extracted the host name
from an X.509 certificate subject's Common Name (CN) field.
A man-in-the-middle attacker could use this flaw to spoof an SSL server
using a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)
A Cross-Site Request Forgery (CSRF) flaw was found in the oVirt REST API.
A remote attacker could provide a specially crafted web page that, when
visited by a user with a valid REST API session, would allow the attacker
to trigger calls to the oVirt REST API. (CVE-2014-0151)
It was found that the oVirt web admin interface did not include the
HttpOnly flag when setting session IDs with the Set-Cookie header.
This flaw could make it is easier for a remote attacker to hijack an oVirt
web admin session by leveraging a cross-site scripting (XSS) vulnerability.
(CVE-2014-0154)
The CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat
Product Security.
These updated Red Hat Enterprise Virtualization Manager packages also
include numerous bug fixes and various enhancements. Space precludes
documenting all of these changes in this advisory. Users are directed to
the Red Hat Enterprise Virtualization 3.5 Manager Release Notes document,
linked to in the References, for information on the most significant of
these changes.
All Red Hat Enterprise Virtualization Manager users are advised to upgrade
to these updated packages, which resolve these issues and add these
enhancements.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
5.8 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:0158
A Cross-Site Request Forgery (CSRF) flaw was found in the oVirt REST API. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid REST API session, would allow the attacker to trigger calls to the oVirt REST API.
4.3 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:0158
It was found that the oVirt web admin interface did not include the HttpOnly flag when setting session IDs with the Set-Cookie header. This flaw could make it is easier for a remote attacker to hijack an oVirt web admin session by leveraging a cross-site scripting (XSS) vulnerability.
4.3 ()
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:0158
It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject's Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.
4.8 (Medium)
Vendor Fix
Before applying this update, make sure all previously released errata
relevant to your system have been applied.
This update is available via the Red Hat Network. Details on how to use the
Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258
https://access.redhat.com/errata/RHSA-2015:0158
References
Acknowledgments
Red Hat Product Security
Florian Weimer
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Enterprise Virtualization Manager 3.5.0 is now available.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Enterprise Virtualization Manager is a visual tool for centrally\nmanaging collections of virtual servers running Red Hat Enterprise Linux\nand Microsoft Windows. This package also includes the Red Hat Enterprise\nVirtualization Manager API, a set of scriptable commands that give\nadministrators the ability to perform queries and operations on Red Hat\nEnterprise Virtualization Manager.\n\nThe Manager is a JBoss Application Server application that provides several\ninterfaces through which the virtual environment can be accessed and\ninteracted with, including an Administration Portal, a User Portal, and a\nRepresentational State Transfer (REST) Application Programming Interface\n(API).\n\nIt was discovered that the HttpClient incorrectly extracted the host name\nfrom an X.509 certificate subject\u0027s Common Name (CN) field.\nA man-in-the-middle attacker could use this flaw to spoof an SSL server\nusing a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577)\n\nA Cross-Site Request Forgery (CSRF) flaw was found in the oVirt REST API.\nA remote attacker could provide a specially crafted web page that, when\nvisited by a user with a valid REST API session, would allow the attacker\nto trigger calls to the oVirt REST API. (CVE-2014-0151)\n\nIt was found that the oVirt web admin interface did not include the\nHttpOnly flag when setting session IDs with the Set-Cookie header.\nThis flaw could make it is easier for a remote attacker to hijack an oVirt\nweb admin session by leveraging a cross-site scripting (XSS) vulnerability.\n(CVE-2014-0154)\n\nThe CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat\nProduct Security.\n\nThese updated Red Hat Enterprise Virtualization Manager packages also\ninclude numerous bug fixes and various enhancements. Space precludes\ndocumenting all of these changes in this advisory. Users are directed to\nthe Red Hat Enterprise Virtualization 3.5 Manager Release Notes document,\nlinked to in the References, for information on the most significant of\nthese changes.\n\nAll Red Hat Enterprise Virtualization Manager users are advised to upgrade\nto these updated packages, which resolve these issues and add these\nenhancements.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2015:0158",
"url": "https://access.redhat.com/errata/RHSA-2015:0158"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.5/html/Manager_Release_Notes/index.html",
"url": "https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.5/html/Manager_Release_Notes/index.html"
},
{
"category": "external",
"summary": "570191",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=570191"
},
{
"category": "external",
"summary": "716511",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=716511"
},
{
"category": "external",
"summary": "723211",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=723211"
},
{
"category": "external",
"summary": "800155",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=800155"
},
{
"category": "external",
"summary": "804530",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=804530"
},
{
"category": "external",
"summary": "817180",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=817180"
},
{
"category": "external",
"summary": "828591",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=828591"
},
{
"category": "external",
"summary": "832167",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=832167"
},
{
"category": "external",
"summary": "859024",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=859024"
},
{
"category": "external",
"summary": "874328",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=874328"
},
{
"category": "external",
"summary": "878662",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=878662"
},
{
"category": "external",
"summary": "879077",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=879077"
},
{
"category": "external",
"summary": "884653",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=884653"
},
{
"category": "external",
"summary": "890517",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=890517"
},
{
"category": "external",
"summary": "894027",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=894027"
},
{
"category": "external",
"summary": "894084",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=894084"
},
{
"category": "external",
"summary": "895222",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=895222"
},
{
"category": "external",
"summary": "902298",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=902298"
},
{
"category": "external",
"summary": "906243",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=906243"
},
{
"category": "external",
"summary": "906938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=906938"
},
{
"category": "external",
"summary": "912057",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=912057"
},
{
"category": "external",
"summary": "918138",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=918138"
},
{
"category": "external",
"summary": "920708",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=920708"
},
{
"category": "external",
"summary": "922377",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=922377"
},
{
"category": "external",
"summary": "928727",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=928727"
},
{
"category": "external",
"summary": "947965",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=947965"
},
{
"category": "external",
"summary": "955235",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=955235"
},
{
"category": "external",
"summary": "961753",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=961753"
},
{
"category": "external",
"summary": "962220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=962220"
},
{
"category": "external",
"summary": "962880",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=962880"
},
{
"category": "external",
"summary": "967466",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=967466"
},
{
"category": "external",
"summary": "977079",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=977079"
},
{
"category": "external",
"summary": "977306",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=977306"
},
{
"category": "external",
"summary": "985945",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=985945"
},
{
"category": "external",
"summary": "987295",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=987295"
},
{
"category": "external",
"summary": "987299",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=987299"
},
{
"category": "external",
"summary": "988392",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=988392"
},
{
"category": "external",
"summary": "988422",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=988422"
},
{
"category": "external",
"summary": "989546",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=989546"
},
{
"category": "external",
"summary": "996512",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=996512"
},
{
"category": "external",
"summary": "999975",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=999975"
},
{
"category": "external",
"summary": "1001419",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1001419"
},
{
"category": "external",
"summary": "1003785",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1003785"
},
{
"category": "external",
"summary": "1007133",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1007133"
},
{
"category": "external",
"summary": "1008512",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1008512"
},
{
"category": "external",
"summary": "1013670",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1013670"
},
{
"category": "external",
"summary": "1014326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1014326"
},
{
"category": "external",
"summary": "1015186",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1015186"
},
{
"category": "external",
"summary": "1016916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1016916"
},
{
"category": "external",
"summary": "1022795",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1022795"
},
{
"category": "external",
"summary": "1025376",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1025376"
},
{
"category": "external",
"summary": "1025831",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1025831"
},
{
"category": "external",
"summary": "1028387",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1028387"
},
{
"category": "external",
"summary": "1029934",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1029934"
},
{
"category": "external",
"summary": "1032686",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1032686"
},
{
"category": "external",
"summary": "1034309",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1034309"
},
{
"category": "external",
"summary": "1034885",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1034885"
},
{
"category": "external",
"summary": "1038632",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1038632"
},
{
"category": "external",
"summary": "1040952",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1040952"
},
{
"category": "external",
"summary": "1043430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043430"
},
{
"category": "external",
"summary": "1043808",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1043808"
},
{
"category": "external",
"summary": "1044033",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1044033"
},
{
"category": "external",
"summary": "1044042",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1044042"
},
{
"category": "external",
"summary": "1048019",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1048019"
},
{
"category": "external",
"summary": "1052348",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1052348"
},
{
"category": "external",
"summary": "1053884",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1053884"
},
{
"category": "external",
"summary": "1058022",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1058022"
},
{
"category": "external",
"summary": "1059435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1059435"
},
{
"category": "external",
"summary": "1061156",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1061156"
},
{
"category": "external",
"summary": "1062435",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1062435"
},
{
"category": "external",
"summary": "1064273",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1064273"
},
{
"category": "external",
"summary": "1064544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1064544"
},
{
"category": "external",
"summary": "1065753",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1065753"
},
{
"category": "external",
"summary": "1067162",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1067162"
},
{
"category": "external",
"summary": "1070348",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1070348"
},
{
"category": "external",
"summary": "1070823",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1070823"
},
{
"category": "external",
"summary": "1071217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1071217"
},
{
"category": "external",
"summary": "1076705",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1076705"
},
{
"category": "external",
"summary": "1077284",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1077284"
},
{
"category": "external",
"summary": "1079583",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1079583"
},
{
"category": "external",
"summary": "1080144",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1080144"
},
{
"category": "external",
"summary": "1081533",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1081533"
},
{
"category": "external",
"summary": "1081849",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1081849"
},
{
"category": "external",
"summary": "1081896",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1081896"
},
{
"category": "external",
"summary": "1082110",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1082110"
},
{
"category": "external",
"summary": "1082681",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1082681"
},
{
"category": "external",
"summary": "1083760",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083760"
},
{
"category": "external",
"summary": "1083763",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083763"
},
{
"category": "external",
"summary": "1083766",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083766"
},
{
"category": "external",
"summary": "1083769",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083769"
},
{
"category": "external",
"summary": "1083926",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083926"
},
{
"category": "external",
"summary": "1083998",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1083998"
},
{
"category": "external",
"summary": "1084120",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1084120"
},
{
"category": "external",
"summary": "1084611",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1084611"
},
{
"category": "external",
"summary": "1085136",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1085136"
},
{
"category": "external",
"summary": "1085380",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1085380"
},
{
"category": "external",
"summary": "1087745",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1087745"
},
{
"category": "external",
"summary": "1087917",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1087917"
},
{
"category": "external",
"summary": "1091692",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1091692"
},
{
"category": "external",
"summary": "1092609",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092609"
},
{
"category": "external",
"summary": "1092884",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1092884"
},
{
"category": "external",
"summary": "1093393",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093393"
},
{
"category": "external",
"summary": "1093742",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093742"
},
{
"category": "external",
"summary": "1093784",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093784"
},
{
"category": "external",
"summary": "1093786",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1093786"
},
{
"category": "external",
"summary": "1095240",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1095240"
},
{
"category": "external",
"summary": "1096662",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1096662"
},
{
"category": "external",
"summary": "1096971",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1096971"
},
{
"category": "external",
"summary": "1097256",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1097256"
},
{
"category": "external",
"summary": "1097622",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1097622"
},
{
"category": "external",
"summary": "1098591",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1098591"
},
{
"category": "external",
"summary": "1098638",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1098638"
},
{
"category": "external",
"summary": "1098791",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1098791"
},
{
"category": "external",
"summary": "1100194",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1100194"
},
{
"category": "external",
"summary": "1100810",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1100810"
},
{
"category": "external",
"summary": "1101018",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1101018"
},
{
"category": "external",
"summary": "1101565",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1101565"
},
{
"category": "external",
"summary": "1102018",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1102018"
},
{
"category": "external",
"summary": "1103490",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103490"
},
{
"category": "external",
"summary": "1103676",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103676"
},
{
"category": "external",
"summary": "1103707",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103707"
},
{
"category": "external",
"summary": "1103976",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1103976"
},
{
"category": "external",
"summary": "1104030",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1104030"
},
{
"category": "external",
"summary": "1104195",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1104195"
},
{
"category": "external",
"summary": "1104233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1104233"
},
{
"category": "external",
"summary": "1109326",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109326"
},
{
"category": "external",
"summary": "1109721",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1109721"
},
{
"category": "external",
"summary": "1110172",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1110172"
},
{
"category": "external",
"summary": "1110636",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1110636"
},
{
"category": "external",
"summary": "1111551",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1111551"
},
{
"category": "external",
"summary": "1112359",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1112359"
},
{
"category": "external",
"summary": "1113499",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1113499"
},
{
"category": "external",
"summary": "1113937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1113937"
},
{
"category": "external",
"summary": "1114041",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114041"
},
{
"category": "external",
"summary": "1114241",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114241"
},
{
"category": "external",
"summary": "1114244",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114244"
},
{
"category": "external",
"summary": "1114253",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114253"
},
{
"category": "external",
"summary": "1114260",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114260"
},
{
"category": "external",
"summary": "1114554",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1114554"
},
{
"category": "external",
"summary": "1115845",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1115845"
},
{
"category": "external",
"summary": "1115966",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1115966"
},
{
"category": "external",
"summary": "1116486",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1116486"
},
{
"category": "external",
"summary": "1118191",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1118191"
},
{
"category": "external",
"summary": "1118818",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1118818"
},
{
"category": "external",
"summary": "1118847",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1118847"
},
{
"category": "external",
"summary": "1118879",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1118879"
},
{
"category": "external",
"summary": "1119922",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1119922"
},
{
"category": "external",
"summary": "1120197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120197"
},
{
"category": "external",
"summary": "1128949",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1128949"
},
{
"category": "external",
"summary": "1120829",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120829"
},
{
"category": "external",
"summary": "1120858",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1120858"
},
{
"category": "external",
"summary": "1121454",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1121454"
},
{
"category": "external",
"summary": "1123396",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1123396"
},
{
"category": "external",
"summary": "1123754",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1123754"
},
{
"category": "external",
"summary": "1125834",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1125834"
},
{
"category": "external",
"summary": "1126839",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1126839"
},
{
"category": "external",
"summary": "1129012",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129012"
},
{
"category": "external",
"summary": "1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "1129634",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129634"
},
{
"category": "external",
"summary": "1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "1130076",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1130076"
},
{
"category": "external",
"summary": "1131693",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1131693"
},
{
"category": "external",
"summary": "1132078",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1132078"
},
{
"category": "external",
"summary": "1132191",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1132191"
},
{
"category": "external",
"summary": "1133938",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1133938"
},
{
"category": "external",
"summary": "1134009",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1134009"
},
{
"category": "external",
"summary": "1136087",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1136087"
},
{
"category": "external",
"summary": "1139866",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1139866"
},
{
"category": "external",
"summary": "1140098",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1140098"
},
{
"category": "external",
"summary": "1140430",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1140430"
},
{
"category": "external",
"summary": "1141693",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1141693"
},
{
"category": "external",
"summary": "1142233",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1142233"
},
{
"category": "external",
"summary": "1148379",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148379"
},
{
"category": "external",
"summary": "1148623",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1148623"
},
{
"category": "external",
"summary": "1149135",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1149135"
},
{
"category": "external",
"summary": "1149235",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1149235"
},
{
"category": "external",
"summary": "1153544",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1153544"
},
{
"category": "external",
"summary": "1154607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1154607"
},
{
"category": "external",
"summary": "1154630",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1154630"
},
{
"category": "external",
"summary": "1156577",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1156577"
},
{
"category": "external",
"summary": "1157211",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1157211"
},
{
"category": "external",
"summary": "1160889",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1160889"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2015/rhsa-2015_0158.json"
}
],
"title": "Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.5.0",
"tracking": {
"current_release_date": "2026-01-28T22:35:13+00:00",
"generator": {
"date": "2026-01-28T22:35:13+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.16"
}
},
"id": "RHSA-2015:0158",
"initial_release_date": "2015-02-11T17:38:50+00:00",
"revision_history": [
{
"date": "2015-02-11T17:38:50+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2015-02-11T17:38:50+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-01-28T22:35:13+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "RHEV-M 3.5",
"product": {
"name": "RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhev_manager:3"
}
}
}
],
"category": "product_family",
"name": "Red Hat Virtualization"
},
{
"branches": [
{
"category": "product_version",
"name": "rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-tools@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-websocket-proxy@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-restapi@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup-plugin-ovirt-engine-common@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup-plugin-websocket-proxy@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup-plugin-ovirt-engine@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-extensions-api-impl-javadoc@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-userportal@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-backend@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup-base@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-webadmin-portal@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-extensions-api-impl@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup-plugin-allinone@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-dbscripts@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-setup@3.5.0-0.29.el6ev?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"product": {
"name": "rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"product_id": "rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm-lib@3.5.0-0.29.el6ev?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rhevm-0:3.5.0-0.29.el6ev.src",
"product": {
"name": "rhevm-0:3.5.0-0.29.el6ev.src",
"product_id": "rhevm-0:3.5.0-0.29.el6ev.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhevm@3.5.0-0.29.el6ev?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-0:3.5.0-0.29.el6ev.src as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src"
},
"product_reference": "rhevm-0:3.5.0-0.29.el6ev.src",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-backend-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-lib-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-restapi-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-tools-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-userportal-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch as a component of RHEV-M 3.5",
"product_id": "6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
},
"product_reference": "rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"relates_to_product_reference": "6Server-RHEV-S-3.5"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Florian Weimer"
],
"organization": "Red Hat Product Security",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6153",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129916"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-5783 was incomplete: the code added to check that the server host name matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Virtualization 6. A future update may address this issue.\n\nThis issue did not affect the jakarta-commons-httpclient packages as shipped with Red Hat Enterprise Linux 5, 6, and 7, and httpcomponents-client packages as shipped with Red Hat Enterprise Linux 7.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6153"
},
{
"category": "external",
"summary": "RHBZ#1129916",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129916"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6153",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6153"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6153"
}
],
"release_date": "2014-08-14T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-11T17:38:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-5783 fix"
},
{
"cve": "CVE-2014-0151",
"cwe": {
"id": "CWE-352",
"name": "Cross-Site Request Forgery (CSRF)"
},
"discovery_date": "2014-03-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1081849"
}
],
"notes": [
{
"category": "description",
"text": "A Cross-Site Request Forgery (CSRF) flaw was found in the oVirt REST API. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid REST API session, would allow the attacker to trigger calls to the oVirt REST API.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ovirt-engine: cross-site request forgery (CSRF)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0151"
},
{
"category": "external",
"summary": "RHBZ#1081849",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1081849"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0151",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0151"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0151",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0151"
}
],
"release_date": "2014-03-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-11T17:38:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ovirt-engine: cross-site request forgery (CSRF)"
},
{
"cve": "CVE-2014-0154",
"cwe": {
"id": "CWE-522",
"name": "Insufficiently Protected Credentials"
},
"discovery_date": "2014-03-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1081896"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the oVirt web admin interface did not include the HttpOnly flag when setting session IDs with the Set-Cookie header. This flaw could make it is easier for a remote attacker to hijack an oVirt web admin session by leveraging a cross-site scripting (XSS) vulnerability.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ovirt-engine-webadmin: HttpOnly flag is not included when the session ID is set",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-0154"
},
{
"category": "external",
"summary": "RHBZ#1081896",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1081896"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-0154",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-0154"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0154",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0154"
}
],
"release_date": "2014-03-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-11T17:38:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ovirt-engine-webadmin: HttpOnly flag is not included when the session ID is set"
},
{
"cve": "CVE-2014-3577",
"cwe": {
"id": "CWE-297",
"name": "Improper Validation of Certificate with Host Mismatch"
},
"discovery_date": "2014-08-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1129074"
}
],
"notes": [
{
"category": "description",
"text": "It was found that the fix for CVE-2012-6153 was incomplete: the code added to check that the server hostname matches the domain name in a subject\u0027s Common Name (CN) field in X.509 certificates was flawed. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/solutions/1165533\n\nThis issue affects the versions of HttpComponents Client as shipped with Red Hat JBoss Data Grid 6 and Red Hat JBoss Data Virtualization 6; and ModeShape Client as shipped with Red Hat JBoss Data Virtualization 6. However, this flaw is not known to be exploitable under any supported scenario in Red Hat JBoss Data Grid 6 and JBoss Data Virtualization 6. A future update may address this issue.\n\nRed Hat JBoss Enterprise Application Platform 4, Red Hat JBoss SOA Platform 4, and Red Hat JBoss Web Server 1 are now in Phase 3, Extended Life Support, of their respective life cycles. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat JBoss Middleware and Red Hat JBoss Operations Network Product Update and Support Policy: https://access.redhat.com/support/policy/updates/jboss_notes/\n\nFuse ESB 4, Fuse Message Broker 5.2, 5.3, 5.4 and Fuse Services Framework 2.3, 2.4 are now in a reduced support phase receiving only Critical impact security fixes. This issue has been rated as having Important security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Fuse Product Life Cycle: https://access.redhat.com/support/policy/updates/fusesource/",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2014-3577"
},
{
"category": "external",
"summary": "RHBZ#1129074",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1129074"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2014-3577",
"url": "https://www.cve.org/CVERecord?id=CVE-2014-3577"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2014-3577"
}
],
"release_date": "2014-08-18T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2015-02-11T17:38:50+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2015:0158"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-0:3.5.0-0.29.el6ev.src",
"6Server-RHEV-S-3.5:rhevm-backend-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-dbscripts-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-extensions-api-impl-javadoc-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-lib-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-restapi-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-base-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-allinone-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-ovirt-engine-common-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-setup-plugin-websocket-proxy-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-tools-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-userportal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-webadmin-portal-0:3.5.0-0.29.el6ev.noarch",
"6Server-RHEV-S-3.5:rhevm-websocket-proxy-0:3.5.0-0.29.el6ev.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "CXF: SSL hostname verification bypass, incomplete CVE-2012-6153 fix"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…