(RHSA-2018:0049) Important: ovirt-guest-agent-docker security and bug fix update

The ovirt-guest-agent-docker package provides the guest agent for Red Hat Linux Atomic Host virtual machines. The guest agent allows the Red Hat Virtualization Manager to receive internal guest events and retrieve information such as the IP address and the list of installed applications from the...

(RHSA-2018:0044) Important: redhat-virtualization-host security update

The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts RHVH are installed using a special build of Red Hat Enterprise Linux with only the packages required to host...

ovirt-engine: webadmin log out must logout all sessions

It was discovered that the ovirt-engine webadmin session would not properly enforce timeouts. Browser sessions would remain logged in beyond the administratively configured session timeout period...

Red Hat oVirt Engine Information Disclosure Vulnerability (CNVD-2017-38353)

Red Hat oVirt Engine is an open source virtualization management platform from Red Hat Red Hat, an open source version of RHEV Platform for Enterprise Virtualization, consisting of the oVirt-node client and the overt-engine management side . An information disclosure vulnerability exists in Red H...

CVE-2017-15113

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...

Red Hat Enterprise Virtualization ovirt-node formatting string vulnerability

Red Hat Enterprise Virtualization RHEV is a suite of virtualization management solutions for servers and desktops enterprise virtualization platform from Red Hat, Inc. that provides live migration, load balancing, and more. ovirt-node is one of the open source virtualization management platform...

ovirt-engine: DEBUG logging includes unmasked passwords

ovirt-engine before version 4.1.7.6 with log level set to DEBUG includes passwords in the log file without masking. Only administrators can change the log level and only administrators can access the logs. This presents a risk when debug-level logs are shared with vendors or other parties to...

Red Hat MRG ovirt-engine certificate validation security bypass vulnerability

Red Hat MRG is a suite of IT infrastructure platforms for integrated high-performance computing HPC from Red Hat, Inc. ovirt-engine is one of the open source virtualization management platform. A security vulnerability exists in ovirt-engine in Red Hat MRG version 3, which stems from the program'...

Red Hat oVirt Privilege Acquisition Vulnerability

Red Hat Ovirt is the United States Red Hat Red Hat company's set of open source virtualization management platform , is the RHEV enterprise virtualization platform of the open source version , by ovirt-node client and overt-engine management side . A security vulnerability exists in Red Hat oVirt...

CVE-2014-3706

ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...

Code injection

ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...

CVE-2014-3706

CVE-2014-3706 affects ovirt-engine (as used in Red Hat MRG 3). The vulnerability stems from failure to verify key attributes in vdsm X.509 certificates, enabling MITM attackers to spoof servers. Public details in the provided documents confirm the issue and its impact on server authentication. Mu...

CVE-2014-3706

ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...

PT-2017-5883

Name of the Vulnerable Software and Affected Versions: ovirt-engine affected versions not specified Description: The issue allows man-in-the-middle attackers to spoof servers. This is due to a failure to verify key attributes in vdsm X.509 certificates. Recommendations: At the moment, there is no...

CVE-2014-3706: Improper Certificate Validation

ovirt-engine, as used in Red Hat MRG 3, allows man-in-the-middle attackers to spoof servers by leveraging failure to verify key attributes in vdsm X.509 certificates...

Session fixation

oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user...

CVE-2014-7851

oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user...

CVE-2014-7851

oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user...

CVE-2014-7851

Vulnerability CVE-2014-7851 affects oVirt 3.2.2–3.5.0 where restapi sessions are not invalidated after logout from webadmin, enabling remote authenticated users who know another user’s session data to assume that user’s privileges by swapping session tokens. Root cause: restapi session not invali...

CVE-2014-7851

oVirt 3.2.2 through 3.5.0 does not invalidate the restapi session after logout from the webadmin, which allows remote authenticated users with knowledge of another user's session data to gain that user's privileges by replacing their session token with that of another user...