RedHat: RHSA-2021-1186:01 Moderate: RHV Manager (ovirt-engine) 4.4.z

An update for org.ovirt.engine-root, ovirt-engine-ui-extensions, and ovirt-web-ui is now available for Red Hat Virtualization Engine 4.4

Summary

The ovirt-engine package provides the manager for virtualization environments. This manager enables admins to define hosts and networks, as well as to add storage, create VMs and manage user permissions.
Bug Fix(es): * Previously, saving user preferences in the Red Hat Virtualization Manager required the MANIPULATE_USERS permission level. As a result, user preferences were not saved on the server. In this release, the required permission level for saving user preferences was changed to EDIT_PROFILE, which is the permission level assigned by default to all users. As a result, saving user preferences works as expected. (BZ#1920539)
A list of bugs fixed in this update is available in the Technical Notes book:
ml-single/technical_notes
Security Fix(es):
* nodejs-bootstrap-select: not escaping title values on

Summary

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:
https://access.redhat.com/articles/2974891

References

https://access.redhat.com/security/cve/CVE-2019-20921 https://access.redhat.com/security/cve/CVE-2020-28458 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes

Package List

RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4:
Source: ovirt-engine-4.4.5.11-0.1.el8ev.src.rpm ovirt-engine-ui-extensions-1.2.5-1.el8ev.src.rpm ovirt-web-ui-1.6.8-1.el8ev.src.rpm
noarch: ovirt-engine-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-backend-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-dbscripts-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-health-check-bundler-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-restapi-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-setup-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-setup-base-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-setup-plugin-cinderlib-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-setup-plugin-imageio-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-setup-plugin-ovirt-engine-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-setup-plugin-ovirt-engine-common-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-setup-plugin-vmconsole-proxy-helper-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-setup-plugin-websocket-proxy-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-tools-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-tools-backup-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-ui-extensions-1.2.5-1.el8ev.noarch.rpm ovirt-engine-vmconsole-proxy-helper-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-webadmin-portal-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-engine-websocket-proxy-4.4.5.11-0.1.el8ev.noarch.rpm ovirt-web-ui-1.6.8-1.el8ev.noarch.rpm python3-ovirt-engine-lib-4.4.5.11-0.1.el8ev.noarch.rpm rhvm-4.4.5.11-0.1.el8ev.noarch.rpm
These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/

Severity

Advisory ID: RHSA-2021:1186-01

Product: Red Hat Virtualization

Advisory URL: https://access.redhat.com/errata/RHSA-2021:1186

Issued Date: : 2021-04-14

CVE Names: CVE-2019-20921 CVE-2020-28458

Topic

An update for org.ovirt.engine-root, ovirt-engine-ui-extensions, andovirt-web-ui is now available for Red Hat Virtualization Engine 4.4.Red Hat Product Security has rated this update as having a security impactof Moderate. A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed severity rating, is available for each vulnerability fromthe CVE link(s) in the References section.