RHEL 8 : RHV Engine and Host Common Packages security update [ovirt-4.4.9] (Important) (RHSA-2021:4703)

medium Nessus Plugin ID 155599

Language:

Synopsis

The remote Red Hat host is missing a security update for RHV Engine / Host Common Packages.

Description

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:4703 advisory.

The ovirt-engine package provides the Red Hat Virtualization Manager, a centralized management platform that allows system administrators to view and manage virtual machines. The Manager provides a comprehensive range of features including search capabilities, resource management, live migrations, and virtual infrastructure provisioning.

The ovirt.ovirt package (previously ovirt-ansible-collection) manages all oVirt Ansible modules.

The ovirt-ansible-hosted-engine-setup package provides an Ansible role for deploying Red Hat Virtualization Hosted-Engine.

otopi is a standalone, plug-in based installation framework to be used to set up system components. The plug-in nature provides simplicity to add new installation functionality without the complexity of the state and transaction management.

Security Fix(es):

* Ansible: ansible-connection module discloses sensitive info in traceback error message (CVE-2021-3620)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Bug Fix(es):

* A playbook executed by Ansible Engine 2.9.25 inside a virtual machine running on Red Hat Virtualization 4.4.9 correctly detects that this is a virtual machine running on Red Hat Virtualization by using Ansible facts. (BZ#1904085)

* Red Hat Virtualization now supports Ansible-2.9.27 for internal usage. (BZ#2003671)

* Previously, upgrading from Red Hat Virtualization 4.3 failed when using an isolated network during IPv6 deployment. In this release, a forward network is used instead of an isolated network during an IPv6 deployment. As a result, upgrade from Red Hat Virtualization 4.3 using IPv6 now succeeds. (BZ#1947709)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Update the RHEL RHV Engine / Host Common Packages packages based on the guidance in RHSA-2021:4703.

Plugin Details

Severity: Medium

ID: 155599

File Name: redhat-RHSA-2021-4703.nasl

Version: 1.10

Type: local

Agent: unix

Family: Red Hat Local Security Checks

Published: 11/18/2021

Updated: 11/7/2024

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.4

Vendor

Vendor Severity: Important

CVSS v2

Risk Factor: Low

Base Score: 2.1

Temporal Score: 1.6

Vector: CVSS2#AV:L/AC:L/Au:N/C:P/I:N/A:N

CVSS Score Source: CVE-2021-3620

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: p-cpe:/a:redhat:enterprise_linux:ansible, p-cpe:/a:redhat:enterprise_linux:ovirt-ansible-collection, cpe:/o:redhat:enterprise_linux:8, cpe:/o:redhat:enterprise_linux:7

Required KB Items: Host/local_checks_enabled, Host/RedHat/release, Host/RedHat/rpm-list, Host/cpu

Exploit Ease: No known exploits are available

Patch Publication Date: 11/16/2021

Vulnerability Publication Date: 11/19/2021

Reference Information

CVE: CVE-2021-3620

CWE: 209

RHSA: 2021:4703

Detections

Analytics