PT-2016-5960 · Red Hat · Red Hat Enterprise Virtualization Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization RHEV Manager version 3.6 Description: The issue allows local users to access sensitive information, including encryption keys and certificates, by reading the engine-setup log file. Recommendations: For Red H...

RHEL 7 : org.ovirt.engine-root (RHSA-2016:1967)

An update for org.ovirt.engine-root is now available for RHEV Engine version 4.0. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: org.ovirt.engine-root security, bug fix, and enhancement update

An update for org.ovirt.engine-root is now available for RHEV Engine version 4.0. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

Moderate: Red Hat Security Advisory: Red Hat Virtualization Manager (RHV) bug fix 3.6.9

An update for org.ovirt.engine-root is now available for RHEV Manager version 3.6. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

The vulnerability of the Red Hat Enterprise Virtualization operating system allows a remote attacker to execute arbitrary code or cause a service failure.

The vulnerability of the rhev-hypervisor6-6.6 package of the Red Hat Enterprise Virtualization operating system lies in a buffer overflow within the nsshostnamedigitsdots function, which is used by functions like gethostbyname and gethostbyname2. As a result of exploiting this vulnerability, a...

redhat-support-plugin-rhev: Remote code execution by SuperUser role on hosts in RHEV

It was found that redhat-support-plugin-rhev passed a user-specified path and file name directly to the command line in the log viewer component. This could allow users with the SuperUser role on any Entity to execute arbitrary commands on any host in the RHEV environment...

RHEV-M: webadmin automatic logout fails if VM is selected

It was found that the idle timeout in the Red Hat Enterprise Virtualization Manager Web Admin interface failed to log out a session if a VM has been selected in the VM grid view. This could allow a local attacker to access the web interface if it was left unattended...

RHEL 6 : Virtualization Manager (RHSA-2015:0158)

Red Hat Enterprise Virtualization Manager 3.5.0 is now available. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links...

CVE-2015-0237

Red Hat Enterprise Virtualization RHEV Manager before 3.5.1 ignores the permission to deny snapshot creation during live storage migration between domains, which allows remote authenticated users to cause a denial of service prevent host start by creating a long snapshot chain...

PT-2015-4534 · Red Hat · Red Hat Enterprise Virtualization

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization RHEV Manager versions prior to 3.5.1 Description: The issue allows remote authenticated users to cause a denial of service by creating a long snapshot chain during live storage migration between domains, as t...

Important: Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.5.0

Red Hat Enterprise Virtualization Manager 3.5.0 is now available. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links...

CVE-2014-3561

The rhevm-log-collector package in Red Hat Enterprise Virtualization 3.4 uses the PostgreSQL database password on the command line when calling sosreport, which allows local users to obtain sensitive information by listing the processes...

PT-2014-5396 · Postgresql +1 · Postgresql +2

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization version 3.4 Description: The issue allows local users to obtain sensitive information, specifically the PostgreSQL database password, by listing the processes. This is because the rhevm-log-collector package...

PT-2014-5395 · Red Hat · Red Hat Enterprise Virtualization

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization version 3.4 Description: The issue concerns the oVirt storage backend, which fails to wipe memory snapshots when a virtual machine VM is deleted, even if wipe-after-delete WAD is configured for the VM's disk...

ovirt-engine-reports: various configuration files are world-readable

ovirt-engine-reports, as used in the Red Hat Enterprise Virtualization reports package rhevm-reports before 3.3.3, uses world-readable permissions on configuration files, which allows local users to obtain sensitive information by reading the files...

PT-2014-3112 · Red Hat · Red Hat Enterprise Virtualization Manager

Name of the Vulnerable Software and Affected Versions: Red Hat Enterprise Virtualization Manager RHEV-M versions prior to 3.3 Description: The issue allows man-in-the-middle attackers to spoof the SPICE server due to the remote-viewer initially making insecure connections to the SPICE server when...

Important: Red Hat Security Advisory: Red Hat Enterprise Virtualization Manager 3.3.0 update

Red Hat Enterprise Virtualization Manager 3.3 is now available. The Red Hat Security Response Team has rated this update as having important security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available from the CVE link in the...

ovirt-engine: RedirectServlet cross-site scripting flaw

Cross-site scripting XSS vulnerability in the addAlert function in the RedirectServlet servlet in oVirt Engine and Red Hat Enterprise Virtualization Manager RHEV-M, as used in Red Hat Enterprise Virtualization 3 and 3.2, allows remote attackers to inject arbitrary web script or HTML via unspecifi...

CVE-2013-0167

VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via guestInfo dictionaries with "unexpected fields."...

vdsm: incomplete fix for CVE-2013-0167 issue

VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via invalid XML characters in a guest agent response. NOTE: this issue is due to an incomplete fix for CVE-2013-0167...