rhsa-2021_2239
Vulnerability from csaf_redhat
Published
2021-06-03 10:26
Modified
2024-11-22 15:50
Summary
Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.4.6]

Notes

Topic
An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Security Fix(es): * python-cryptography: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25659) * krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS (CVE-2020-28196) * python-cryptography: certain sequences of update() calls when symmetrically encrypting very large payloads could result in an integer overflow and lead to buffer overflows (CVE-2020-36242) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Bug Fix(es): * Previously, old RPM files were not properly removed during package removal (uninistall) or upgrade. As a result, removed packages were reinstalled, or, during and upgrade, the system tried to install two or more different versions at once, causing the upgrade to fail. In this release, the dnf plugin has been fixed, and RPM packages are now properly removed. The new version will also auto-heal the broken system by removing RPM packages which are not supposed to be in the persisted-rpms directory. (BZ#1936972) * With this release, ovirt-hosted-engine-ha supports multiple, comma-separated values for all iSCSI configuration items. (BZ#1909888)
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.


To clipboard 

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Moderate"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host\u0027s resources and performing administrative tasks.\n\nThe redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host\u0027s resources and performing administrative tasks. \n\nThe ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host\u0027s resources and performing administrative tasks.\n\nSecurity Fix(es):\n\n* python-cryptography: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25659)\n\n* krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS (CVE-2020-28196)\n\n* python-cryptography: certain sequences of update() calls when symmetrically encrypting very large payloads could result in an integer overflow and lead to buffer overflows (CVE-2020-36242)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nBug Fix(es):\n\n* Previously, old RPM files were not properly removed during package removal (uninistall) or upgrade. As a result, removed packages were reinstalled, or, during and upgrade, the system tried to install two or more different versions at once, causing the upgrade to fail.\nIn this release, the dnf plugin has been fixed, and RPM packages are now properly removed.\nThe new version will also auto-heal the broken system by removing RPM packages which are not supposed to be in the persisted-rpms directory. (BZ#1936972)\n\n* With this release, ovirt-hosted-engine-ha supports multiple, comma-separated values for all iSCSI configuration items. (BZ#1909888)",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2021:2239",
        "url": "https://access.redhat.com/errata/RHSA-2021:2239"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#moderate",
        "url": "https://access.redhat.com/security/updates/classification/#moderate"
      },
      {
        "category": "external",
        "summary": "1779052",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1779052"
      },
      {
        "category": "external",
        "summary": "1882542",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1882542"
      },
      {
        "category": "external",
        "summary": "1889988",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889988"
      },
      {
        "category": "external",
        "summary": "1897893",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1897893"
      },
      {
        "category": "external",
        "summary": "1901041",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901041"
      },
      {
        "category": "external",
        "summary": "1901878",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901878"
      },
      {
        "category": "external",
        "summary": "1909888",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1909888"
      },
      {
        "category": "external",
        "summary": "1926226",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926226"
      },
      {
        "category": "external",
        "summary": "1931443",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1931443"
      },
      {
        "category": "external",
        "summary": "1936972",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1936972"
      },
      {
        "category": "external",
        "summary": "1938925",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1938925"
      },
      {
        "category": "external",
        "summary": "1942580",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1942580"
      },
      {
        "category": "external",
        "summary": "1944632",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1944632"
      },
      {
        "category": "external",
        "summary": "1946095",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1946095"
      },
      {
        "category": "external",
        "summary": "1948944",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1948944"
      },
      {
        "category": "external",
        "summary": "1949431",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1949431"
      },
      {
        "category": "external",
        "summary": "1957604",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1957604"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2239.json"
      }
    ],
    "title": "Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.4.6]",
    "tracking": {
      "current_release_date": "2024-11-22T15:50:49+00:00",
      "generator": {
        "date": "2024-11-22T15:50:49+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2021:2239",
      "initial_release_date": "2021-06-03T10:26:34+00:00",
      "revision_history": [
        {
          "date": "2021-06-03T10:26:34+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2021-06-03T10:26:34+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-22T15:50:49+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
                "product": {
                  "name": "RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
                  "product_id": "8Base-RHV-HypervisorBuild-4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
                "product": {
                  "name": "Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
                  "product_id": "8Base-RHV-Agents-4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Virtualization 4 Hypervisor for RHEL 8",
                "product": {
                  "name": "Red Hat Virtualization 4 Hypervisor for RHEL 8",
                  "product_id": "8Base-RHV-Hypervisor-4",
                  "product_identification_helper": {
                    "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Virtualization"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
                "product": {
                  "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
                  "product_id": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-release-virtualization-host@4.4.6-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "imgbased-0:1.2.19-1.el8ev.src",
                "product": {
                  "name": "imgbased-0:1.2.19-1.el8ev.src",
                  "product_id": "imgbased-0:1.2.19-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/imgbased@1.2.19-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "scap-security-guide-0:0.1.54-1.el8ev.src",
                "product": {
                  "name": "scap-security-guide-0:0.1.54-1.el8ev.src",
                  "product_id": "scap-security-guide-0:0.1.54-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/scap-security-guide@0.1.54-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
                "product": {
                  "name": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
                  "product_id": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-ovirt@0.15.0-2.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
                "product": {
                  "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
                  "product_id": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-hosted-engine-ha@2.4.7-1.el8ev?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
                "product": {
                  "name": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
                  "product_id": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-virtualization-host@4.4.6-20210527.3.el8_4?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
                "product": {
                  "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
                  "product_id": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-release-virtualization-host@4.4.6-1.el8ev?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfod-client@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debugsource-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debugsource-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debugsource-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debugsource@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfod-client-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-debuginfod-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-libelf-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
                "product": {
                  "name": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
                  "product_id": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/elfutils-libs-debuginfo@0.182-3.el8?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
                "product": {
                  "name": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
                  "product_id": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-virtualization-host-image-update@4.4.6-20210527.3.el8_4?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
                "product": {
                  "name": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
                  "product_id": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/redhat-virtualization-host-image-update-placeholder@4.4.6-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "imgbased-0:1.2.19-1.el8ev.noarch",
                "product": {
                  "name": "imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_id": "imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/imgbased@1.2.19-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
                "product": {
                  "name": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_id": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/python3-imgbased@1.2.19-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
                "product": {
                  "name": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
                  "product_id": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/scap-security-guide-rhv@0.1.54-1.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
                "product": {
                  "name": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
                  "product_id": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cockpit-ovirt-dashboard@0.15.0-2.el8ev?arch=noarch"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
                "product": {
                  "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
                  "product_id": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ovirt-hosted-engine-ha@2.4.7-1.el8ev?arch=noarch"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ovirt-0:0.15.0-2.el8ev.src as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src"
        },
        "product_reference": "cockpit-ovirt-0:0.15.0-2.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch"
        },
        "product_reference": "cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch"
        },
        "product_reference": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src as a component of Red Hat Virtualization 4 Management Agent for RHEL 7 Hosts",
          "product_id": "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src"
        },
        "product_reference": "ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-Agents-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-debugsource-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-debugsource-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64"
        },
        "product_reference": "elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src"
        },
        "product_reference": "redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8",
          "product_id": "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        },
        "product_reference": "redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
        "relates_to_product_reference": "8Base-RHV-Hypervisor-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "imgbased-0:1.2.19-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch"
        },
        "product_reference": "imgbased-0:1.2.19-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "imgbased-0:1.2.19-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src"
        },
        "product_reference": "imgbased-0:1.2.19-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "python3-imgbased-0:1.2.19-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch"
        },
        "product_reference": "python3-imgbased-0:1.2.19-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src"
        },
        "product_reference": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64"
        },
        "product_reference": "redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch"
        },
        "product_reference": "redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "scap-security-guide-0:0.1.54-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src"
        },
        "product_reference": "scap-security-guide-0:0.1.54-1.el8ev.src",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)",
          "product_id": "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        },
        "product_reference": "scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch",
        "relates_to_product_reference": "8Base-RHV-HypervisorBuild-4"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Hubert Kario"
          ],
          "organization": "Red Hat",
          "summary": "This issue was discovered by Red Hat."
        }
      ],
      "cve": "CVE-2020-25659",
      "cwe": {
        "id": "CWE-385",
        "name": "Covert Timing Channel"
      },
      "discovery_date": "2020-10-21T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1889988"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in python-cryptography, where it is vulnerable to Bleichenbacher timing attacks. This flaw allows an attacker, via the RSA decryption API, to decrypt parts of the ciphertext encrypted with RSA. The highest threat from this vulnerability is to confidentiality.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "In Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-cryptography package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        ],
        "known_not_affected": [
          "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
          "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
          "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "RHBZ#1889988",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1889988"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-25659",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-25659",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25659"
        },
        {
          "category": "external",
          "summary": "https://cryptography.io/en/latest/changelog.html#v3-2",
          "url": "https://cryptography.io/en/latest/changelog.html#v3-2"
        }
      ],
      "release_date": "2020-10-25T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-03T10:26:34+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2239"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-cryptography: Bleichenbacher timing oracle attack against RSA decryption"
    },
    {
      "cve": "CVE-2020-28196",
      "cwe": {
        "id": "CWE-674",
        "name": "Uncontrolled Recursion"
      },
      "discovery_date": "2020-11-06T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1901041"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A flaw was found in krb5. MIT Kerberos 5 allows unbounded recursion via an ASN.1-encoded Kerberos message because the lib/krb5/asn.1/asn1_encode.c support for BER indefinite lengths lacks a recursion limit.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        ],
        "known_not_affected": [
          "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
          "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
          "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-28196"
        },
        {
          "category": "external",
          "summary": "RHBZ#1901041",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1901041"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-28196",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-28196"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-28196",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28196"
        }
      ],
      "release_date": "2020-11-06T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-03T10:26:34+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2239"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead to DoS"
    },
    {
      "cve": "CVE-2020-36242",
      "cwe": {
        "id": "CWE-119",
        "name": "Improper Restriction of Operations within the Bounds of a Memory Buffer"
      },
      "discovery_date": "2021-02-07T00:00:00+00:00",
      "flags": [
        {
          "label": "vulnerable_code_not_present",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1926226"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A buffer-overflow flaw was found in the python-cryptography package. In certain sequences of ``update()`` calls when symmetrically encrypting very large payloads (\u003e2GB) could result in an integer overflow, leading to buffer overflows. Note: This fix is a workaround for the OpenSSL CVE-2021-23840 flaw. Source: pyca/cryptography project",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "Triggering this flaw on in versions of python-cryptography as shipped with Red Hat Enterprise Linux 8 BaseOS, Appstream, as well as Red Hat Software Collections, can result in denial of service due to memory consumption or MemoryError exception.\n\nIn Red Hat OpenStack Platform, because the flaw has a lower impact and the fix would require a substantial amount of development, no update will be provided at this time for the RHOSP python-cryptography package.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
          "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
        ],
        "known_not_affected": [
          "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
          "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
          "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
          "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
          "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "RHBZ#1926226",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926226"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2020-36242",
          "url": "https://www.cve.org/CVERecord?id=CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2020-36242",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2020-36242"
        },
        {
          "category": "external",
          "summary": "https://cryptography.io/en/latest/changelog.html#v3-3-2",
          "url": "https://cryptography.io/en/latest/changelog.html#v3-3-2"
        }
      ],
      "release_date": "2020-12-09T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2021-06-03T10:26:34+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/2974891",
          "product_ids": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2021:2239"
        },
        {
          "category": "workaround",
          "details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.",
          "product_ids": [
            "8Base-RHV-Agents-4:cockpit-ovirt-0:0.15.0-2.el8ev.src",
            "8Base-RHV-Agents-4:cockpit-ovirt-dashboard-0:0.15.0-2.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.noarch",
            "8Base-RHV-Agents-4:ovirt-hosted-engine-ha-0:2.4.7-1.el8ev.src",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-client-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debuginfod-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-debugsource-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libelf-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:elfutils-libs-debuginfo-0:0.182-3.el8.x86_64",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:imgbased-0:1.2.19-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:python3-imgbased-0:1.2.19-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:redhat-release-virtualization-host-0:4.4.6-1.el8ev.x86_64",
            "8Base-RHV-HypervisorBuild-4:redhat-virtualization-host-image-update-placeholder-0:4.4.6-1.el8ev.noarch",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-0:0.1.54-1.el8ev.src",
            "8Base-RHV-HypervisorBuild-4:scap-security-guide-rhv-0:0.1.54-1.el8ev.noarch"
          ]
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-0:4.4.6-20210527.3.el8_4.src",
            "8Base-RHV-Hypervisor-4:redhat-virtualization-host-image-update-0:4.4.6-20210527.3.el8_4.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "python-cryptography: Large inputs for symmetric encryption can trigger integer overflow leading to buffer overflow"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.