The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:1184 advisory.

    The ovirt-hosted-engine-setup package provides a self-hosted engine tool for the Red Hat Virtualization     Manager. A self-hosted engine is a virtualized environment in which the Manager runs on a virtual machine     on the hosts managed by the Manager.
    Bug Fix(es):

    * In this release, it is now possible to enter a path to the OVA archive for local appliance installation     using the cockpit-ovirt UI. (BZ#1755156)

    * Previously, following a successful migration on the Self-hosted Engine, he HA agent on the source host     immediately moved to the state EngineDown, and shorly thereafter tried to start the engine locally, if the     destination host didn't update the shared storage quickly enough, marking the Manager virtual machine as     being up.
    As a result, starting the virtual machine failed due to a shared lock held by the destination host. This     also resulted in generating false alarms and notifications.
    In this release, the HA agent first moves to the state EngineMaybeAway, providing the destination host     more time to update the shared storage with the updated state. As a result, no notifications or false     alarms are generated.
    Note: in scenarios where the virtual machine needs to be started on the source host, this fix slightly     increases the time it takes the Manager virtual     machine on the source host to start. (BZ#1815589)

    * Previously, if a host in the Self-hosted Engine had an ID number higher than 64, other hosts did not     recognize that host, and the host did not appear in 'hosted-engine --vm-status'.
    In this release, the Self-hosted Engine allows host ID numbers of up to 2000. (BZ#1916032)

    * ovirt-hosted-engine-setup now requires ansible-2.9.17. (BZ#1921108)

    * Previously the logical names for disks without a mounted filesystem were not displayed in the Red Hat     Virtualization Manager.
    In this release, logical names for such disks are properly reported provided the version of QEMU Guest     Agent in the virtual machine is 5.2 or higher. (BZ#1836661)

    * Previously, if the Seal option was used when creating a template for Linux virtual machines, the     original host name was not removed from the template.
    In this release, the host name is set to localhost or the new virtual machine host name. (BZ#1860492)

    * Previously, the used memory of the host didn't take the SReclaimable memory into consideration while it     did for free memory. As a result, there were discrepancies in the host statistics.
    In this release, the SReclaimable memory is a part of the used memory calculation. (BZ#1916519)

    Security Fix(es):

    * datatables.net: prototype pollution if 'constructor' were used in a data property name (CVE-2020-28458)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : RHV Host (ovirt-host) 4.4.z security, (Moderate) (RHSA-2021:1184)

high Nessus Plugin ID 148540

Version 1.11