RHSA-2022:1053HighCVSS 9.8

Red Hat Security Advisory: Red Hat Virtualization Host security and enhancement update [ovirt-4.4.10] Async #2

Published
March 24, 2022
Last Modified
August 4, 2026

🔗 CVE IDs covered (3)

CVE-2022-25235 →CVE-2022-25236 →CVE-2022-25315 →

📋 Description

CVE-2022-25235 — expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution CVE-2022-25236 — expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution CVE-2022-25315 — expat: Integer overflow in storeRawNames()

🎯 Affected products17

  • RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-0:0.185-1.el8.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-debuginfo-0:0.185-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-debuginfod-client-0:0.185-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-debuginfod-client-debuginfo-0:0.185-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-debuginfod-debuginfo-0:0.185-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-debugsource-0:0.185-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-devel-0:0.185-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-libelf-debuginfo-0:0.185-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • elfutils-libs-debuginfo-0:0.185-1.el8.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • redhat-release-virtualization-host-0:4.4.10-3.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-release-virtualization-host-0:4.4.10-3.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-release-virtualization-host-content-0:4.4.10-3.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
  • redhat-virtualization-host-0:4.4.10-202203211649_8.5.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • redhat-virtualization-host-image-update-0:4.4.10-202203211649_8.5.x86_64 as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
  • redhat-virtualization-host-image-update-placeholder-0:4.4.10-3.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 Workaround: There is no known mitigation other than restricting applications using the expat library from processing untrusted XML content. Please update the affected packages as soon as possible.

🔗 References (9)