RHSA-2020:3247HighCVSS 8.1

Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update

Published
August 4, 2020
Last Modified
August 7, 2026

🔗 CVE IDs covered (8)

CVE-2019-13990 →CVE-2019-19336 →CVE-2020-7598 →CVE-2020-10775 →CVE-2020-11022 →CVE-2020-11023 →CVE-2017-18635 →CVE-2019-8331 →

📋 Description

CVE-2017-18635 — novnc: XSS vulnerability via the messages propagated to the status field CVE-2019-8331 — bootstrap: XSS in the tooltip or popover data-template attribute CVE-2019-13990 — libquartz: XXE attacks via job description CVE-2019-19336 — ovirt-engine: response_type parameter allows reflected XSS CVE-2020-7598 — nodejs-minimist: prototype pollution allows adding or modifying properties of Object.prototype using a constructor or proto payload CVE-2020-10775 — ovirt-engine: Redirect to arbitrary URL allows for phishing CVE-2020-11022 — jquery: Cross-site scripting due to improper injQuery.htmlPrefilter method CVE-2020-11023 — jquery: Untrusted code execution via tag in HTML passed to DOM manipulation methods

🎯 Affected products170

  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ansible-runner-0:1.4.5-1.el8ar.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ansible-runner-0:1.4.5-1.el8ar.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ansible-runner-service-0:1.0.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ansible-runner-service-0:1.0.2-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-collections4-0:4.4-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-collections4-0:4.4-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-collections4-javadoc-0:4.4-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-compress-0:1.18-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-compress-0:1.18-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-compress-javadoc-0:1.18-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-configuration-0:1.10-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-configuration-0:1.10-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-jexl-0:2.1.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-jexl-0:2.1.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-jexl-javadoc-0:2.1.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-jxpath-0:1.3-29.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-jxpath-0:1.3-29.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-jxpath-javadoc-0:1.3-29.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-vfs-0:2.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-vfs-0:2.4.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-vfs-ant-0:2.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-vfs-examples-0:2.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-commons-vfs-javadoc-0:2.4.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-sshd-0:2.5.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-sshd-0:2.5.1-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • apache-sshd-javadoc-0:2.5.1-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ebay-cors-filter-0:1.0.1-4.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ebay-cors-filter-0:1.0.1-4.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ed25519-java-0:0.3.0-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • +140 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/2974891 Workaround: There is no known mitigation for this issue, the flaw can only be resolved by applying updates. Workaround: Red Hat has investigated whether a possible mitigation exists for this issue, and has not been able to identify a practical example. Please update the affected package as soon as possible.

🔗 References (246)