CVE-2013-0168

The MoveDisk command in Red Hat Enterprise Virtualization Manager RHEV-M 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service free space consumption of other storage domains via unspecified vectors...

CVE-2012-6115

The domain management tool rhevm-manage-domains in Red Hat Enterprise Virtualization Manager RHEV-M 3.1 and earlier, when the validate action is enabled, logs the administrative password to a world-readable log file, which allows local users to obtain sensitive information by reading this file...

CVE-2013-0168

The MoveDisk command in Red Hat Enterprise Virtualization Manager RHEV-M 3.1 and earlier does not properly check permissions on storage domains, which allows remote authenticated storage admins to cause a denial of service free space consumption of other storage domains via unspecified vectors...

CVE-2012-6115

CVE-2012-6115 affects Red Hat Enterprise Virtualization Manager (RHEV-M) domain management tool: when using rhevm-manage-domains -action=validate on RHEV-M 3.1 and earlier, the administrative password is logged to a world-readable log file. This enables a local attacker to obtain sensitive inform...

(RHSA-2013:0577) Low: Red Hat Enterprise Virtualization 2 - End Of Life

In accordance with the Red Hat Enterprise Virtualization Errata Support Policy, the support for Red Hat Enterprise Virtualization 2 has ended. Customers are recommended to upgrade their existing Red Hat Enterprise Virtualization RHEV 2.x installations to version 3.0. The upgrade from RHEV Manager...

(RHSA-2013:0552) Low: Red Hat Enterprise Virtualization 2 1-week EOL Notice

In accordance with the Red Hat Enterprise Virtualization Errata Support Policy, the support for Red Hat Enterprise Virtualization 2 will end on 1st March, 2013. Customers are recommended to upgrade their existing Red Hat Enterprise Virtualization RHEV 2.x installations to version 3.0. The upgrade...

CVE-2012-5516

Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when moving disks between storage domains, does not properly wipe-after-delete, which prevents disks from being securely deleted and might allow local users to obtain sensitive information via unspecified vectors...

CVE-2012-0860

Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse 1 deployUtil.py or 2 vdsbootstrap.py Python module in /tmp/...

CVE-2012-0861

The vdsinstaller in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vdsbootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via...

CVE-2011-4316

Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, in certain unspecified conditions, does not lock the desktop screen between SPICE sessions, which allows local users with access to a virtual machine to gain access to other users' desktop sessions via unspecified vectors...

CVE-2012-2696

The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...

Cross site request forgery (csrf)

The backend in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1 does not properly check privileges, which allows remote authenticated users to query arbitrary information via a 1 SOAP or 2 GWT request...

CVE-2012-2696

CVE-2012-2696 is a privilege-check flaw in the Red Hat Enterprise Virtualization Manager (RHEV-M) backend before 3.1. An authenticated attacker could issue queries against the RHEV-M SOAP or GWT APIs and read data they should not access, indicating an authorisation bypass in the back end. Connect...

CVE-2012-0860

Concrete details found: CVE-2012-0860 affects Red Hat Enterprise Virtualization Manager (RHEV-M) up to version 3.1. The root cause is that Python configuration scripts (deployUtil.py or vds_bootstrap.py) stored in /tmp/ could be pre-created by a local unprivileged user during host addition, allow...

CVE-2012-0860

Multiple untrusted search path vulnerabilities in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, allow local users to gain privileges via a Trojan horse 1 deployUtil.py or 2 vdsbootstrap.py Python module in /tmp/...

CVE-2011-4316

CVE-2011-4316 affects Red Hat Enterprise Virtualization Manager (RHEV-M) prior to 3.1. The vulnerability arises because the desktop screen is not locked between SPICE sessions under certain conditions, enabling a local user with VM access to view or switch to other users’ desktop sessions via uns...

CVE-2012-0861

The CVE-2012-0861 issue affects Red Hat Enterprise Virtualization Manager (RHEV-M) prior to version 3.1. During host addition, the vds_installer downloads deployUtil.py and vds_bootstrap.py with curl -k, skipping SSL certificate validation. This MITM condition lets an attacker on the local networ...

CVE-2012-0861

The vdsinstaller in Red Hat Enterprise Virtualization Manager RHEV-M before 3.1, when adding a host, uses the -k curl parameter when downloading deployUtil.py and vdsbootstrap.py, which prevents SSL certificates from being validated and allows remote attackers to execute arbitrary Python code via...

PT-2013-1518 · Red Hat · Red Hat Enterprise Virtualization Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager RHEV-M versions prior to 3.1 Description: The issue allows local users to gain privileges via a Trojan horse Python module, specifically deployUtil.py or vds bootstrap.py, in the /tmp/ directory when...

Important: Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.1

Red Hat Enterprise Virtualization Manager 3.1 is now available. The Red Hat Security Response Team has rated this update as having important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each vulnerability from the C...