The remote Redhat Enterprise Linux 8 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2021:2239 advisory.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include     redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH)     are installed using a special build of Red Hat Enterprise Linux with only the packages required to host     virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and     performing administrative tasks.

    The ovirt-node-ng packages provide the Red Hat Virtualization Host. These packages include redhat-release-     virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed     using a special build of Red Hat Enterprise Linux with only the packages required to host virtual     machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing     administrative tasks.

    Security Fix(es):

    * python-cryptography: bleichenbacher timing oracle attack against RSA decryption (CVE-2020-25659)

    * krb5: unbounded recursion via an ASN.1-encoded Kerberos message in lib/krb5/asn.1/asn1_encode.c may lead     to DoS (CVE-2020-28196)

    * python-cryptography: certain sequences of update() calls when symmetrically encrypting very large     payloads could result in an integer overflow and lead to buffer overflows (CVE-2020-36242)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Bug Fix(es):

    * Previously, old RPM files were not properly removed during package removal (uninistall) or upgrade. As a     result, removed packages were reinstalled, or, during and upgrade, the system tried to install two or more     different versions at once, causing the upgrade to fail.
    In this release, the dnf plugin has been fixed, and RPM packages are now properly removed.
    The new version will also auto-heal the broken system by removing RPM packages which are not supposed to     be in the persisted-rpms directory. (BZ#1936972)

    * With this release, ovirt-hosted-engine-ha supports multiple, comma-separated values for all iSCSI     configuration items. (BZ#1909888)

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

RHEL 8 : Red Hat Virtualization Host security update [ovirt-4.4.6] (Moderate) (RHSA-2021:2239)

critical Nessus Plugin ID 165137

Version 1.7