—–BEGIN PGP SIGNED MESSAGE—–
\nHash: SHA256<\/p>\n
====================================================================
\nRed Hat Security Advisory<\/p>\n
Synopsis: Important: RHV-H security update (redhat-virtualization-host) 4.3.23
\nAdvisory ID: RHSA-2022:5439-01
\nProduct: Red Hat Virtualization
\nAdvisory URL: https:\/\/access.redhat.com\/errata\/RHSA-2022:5439
\nIssue date: 2022-06-30
\nCVE Names: CVE-2018-25032 CVE-2022-1271 CVE-2022-1966
\nCVE-2022-24903
\n====================================================================
\n1. Summary:<\/p>\n
An update for redhat-release-virtualization-host and
\nredhat-virtualization-host is now available for Red Hat Virtualization 4
\nfor Red Hat Enterprise Linux 7.<\/p>\n
Red Hat Product Security has rated this update as having a security impact
\nof Important. A Common Vulnerability Scoring System (CVSS) base score,
\nwhich gives a detailed severity rating, is available for each vulnerability
\nfrom the CVE link(s) in the References section.<\/p>\n
2. Relevant releases\/architectures:<\/p>\n
RHEL 7-based RHEV-H for RHEV 4 (build requirements) – noarch, x86_64
\nRed Hat Virtualization 4 Hypervisor for RHEL 7 – noarch<\/p>\n
3. Description:<\/p>\n
The redhat-virtualization-host packages provide the Red Hat Virtualization
\nHost.
\nThese packages include redhat-release-virtualization-host. Red Hat
\nVirtualization Hosts (RHVH) are installed using a special build of Red Hat
\nEnterprise Linux with only the packages required to host virtual machines.
\nRHVH features a Cockpit user interface for monitoring the host’s resources
\nand performing administrative tasks.<\/p>\n
Security Fix(es) from Bugzilla:<\/p>\n
* zlib: A flaw found in zlib when compressing (not decompressing) certain
\ninputs (CVE-2018-25032)<\/p>\n
* gzip: arbitrary-file-write vulnerability (CVE-2022-1271)<\/p>\n
* rsyslog: Heap-based overflow in TCP syslog server (CVE-2022-24903)<\/p>\n
* kernel: a use-after-free write in the netfilter subsystem can lead to
\nprivilege escalation to root (CVE-2022-1966)<\/p>\n
For more details about the security issue(s), including the impact, a CVSS
\nscore, and other related information, refer to the CVE page(s) listed in
\nthe References section.<\/p>\n
Bug Fix(es) from Bugzilla:<\/p>\n
* RHV-H 4.3 has been rebased on RHEL 7.9 batch (BZ#2084444)<\/p>\n
4. Solution:<\/p>\n
For details on how to apply this update, which includes the changes
\ndescribed in this advisory, refer to:<\/p>\n
https:\/\/access.redhat.com\/articles\/2974891<\/p>\n
5. Bugs fixed (https:\/\/bugzilla.redhat.com\/):<\/p>\n
2067945 – CVE-2018-25032 zlib: A flaw found in zlib when compressing (not decompressing) certain inputs
\n2073310 – CVE-2022-1271 gzip: arbitrary-file-write vulnerability
\n2081353 – CVE-2022-24903 rsyslog: Heap-based overflow in TCP syslog server
\n2084444 – Rebase RHV-H 4.3 on RHEL 7.9 batch
\n2092427 – CVE-2022-1966 kernel: a use-after-free write in the netfilter subsystem can lead to privilege escalation to root<\/p>\n
6. Package List:<\/p>\n
Red Hat Virtualization 4 Hypervisor for RHEL 7:<\/p>\n
Source:
\nredhat-virtualization-host-4.3.23-20220622.0.el7_9.src.rpm<\/p>\n
noarch:
\nredhat-virtualization-host-image-update-4.3.23-20220622.0.el7_9.noarch.rpm<\/p>\n
RHEL 7-based RHEV-H for RHEV 4 (build requirements):<\/p>\n
Source:
\nredhat-release-virtualization-host-4.3.23-1.el7ev.src.rpm
\nredhat-virtualization-host-4.3.23-20220622.0.el7_9.src.rpm
\nredhat-virtualization-host-productimg-4.3.23-1.el7.src.rpm<\/p>\n
noarch:
\nredhat-virtualization-host-image-update-4.3.23-20220622.0.el7_9.noarch.rpm
\nredhat-virtualization-host-image-update-placeholder-4.3.23-1.el7ev.noarch.rpm<\/p>\n
x86_64:
\nredhat-release-virtualization-host-4.3.23-1.el7ev.x86_64.rpm
\nredhat-virtualization-host-productimg-4.3.23-1.el7.x86_64.rpm<\/p>\n
These packages are GPG signed by Red Hat for security. Our key and
\ndetails on how to verify the signature are available from
\nhttps:\/\/access.redhat.com\/security\/team\/key\/<\/p>\n
7. References:<\/p>\n
https:\/\/access.redhat.com\/security\/cve\/CVE-2018-25032
\nhttps:\/\/access.redhat.com\/security\/cve\/CVE-2022-1271
\nhttps:\/\/access.redhat.com\/security\/cve\/CVE-2022-1966
\nhttps:\/\/access.redhat.com\/security\/cve\/CVE-2022-24903
\nhttps:\/\/access.redhat.com\/security\/updates\/classification\/#important<\/p>\n
8. Contact:<\/p>\n
The Red Hat security contact is <secalert@redhat.com>. More contact
\ndetails at https:\/\/access.redhat.com\/security\/team\/contact\/<\/p>\n
Copyright 2022 Red Hat, Inc.
\n—–BEGIN PGP SIGNATURE—–
\nVersion: GnuPG v1<\/p>\n
iQIVAwUBYr6VwdzjgjWX9erEAQjlUQ\/\/St4jo4QoQbG6tiIa+jMGjKEXjz+aa4ui
\nBtmQc+LbAzIjM1Wslf+7iuzU5A07CQ+fscVNXXTfmpGKjc5Ci6SaZUGgtk7hLdpt
\ntLx2mY681n\/J43C7QZM2ZeOjYVRjN+t8QHpenSiT0Aw41s23dUtD\/4nXZfwRu74H
\n1zily70MZP0Ukt+sbUn42Ry\/fKGqJU2LVau\/UPqxSkqUj3YskLXNSJmNN7+JVhKj
\ny8z3C5AnYQtytv8QfRBXVvY58upTnN7gXPqLuA2IFnp82yQDmnkeqxl\/ZGZoxUAD
\nF31u0OV+9575GxDjYzaV2RomcBpkMHU\/\/7Mo0RxTKfIPQp5MTZWGkrrMn3RFr4Yc
\nDixfcCXfp9osc7LrL7kV7ZmvdfKxV7VlM3ja7PdKd+S1jRw7Ol6MfgInUWhbWt4t
\nT9y1abRa3YWliSJaTI7IxMM3fH8Smtcozr90+G7pk+MFFAPbw+2VK7yScS+Rpl72
\nzm+5Bkz\/pkpBGEWSXNvJNeTc1xBfZnPTDI2UnX1495mLTpAyK5JhwRp+LvtuMFm+
\nmaVds4CpAssAQvM8tEU9qJdXvzMT9W7jXpzr6QK7C90F6f590Yc4OElJUp\/hGYSL
\nPvaYkhRrZShMJBgPdZnBFeEZkM8f4b+FkBU4WLAJF8Me+Wiodm4mKNRZSXBuDfDo
\nvlSrwW\/9s7I=u0ws
\n—–END PGP SIGNATURE—–
\n—
\nRHSA-announce mailing list
\nRHSA-announce@redhat.com
\nhttps:\/\/listman.redhat.com\/mailman\/listinfo\/rhsa-announce<\/p>\n","protected":false},"excerpt":{"rendered":"
—–BEGIN PGP SIGNED MESSAGE—– Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: RHV-H security update (redhat-virtualization-host) 4.3.23 Advisory ID: RHSA-2022:5439-01 Product: Red Hat Virtualization Advisory URL: https:\/\/access.redhat.com\/errata\/RHSA-2022:5439 Issue date: 2022-06-30 CVE Names: CVE-2018-25032 CVE-2022-1271 CVE-2022-1966 CVE-2022-24903 ==================================================================== 1. Summary: An update for redhat-release-virtualization-host and redhat-virtualization-host is now available for Red Hat Virtualization 4 for …<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[26],"tags":[],"class_list":["post-26380","post","type-post","status-publish","format-standard","hentry","category-vulnerability"],"_links":{"self":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26380","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/comments?post=26380"}],"version-history":[{"count":0,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/posts\/26380\/revisions"}],"wp:attachment":[{"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/media?parent=26380"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/categories?post=26380"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/afaghhosting.net\/blog\/wp-json\/wp\/v2\/tags?post=26380"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}