Protect yourself against future threats.
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 =========================================================================== AUSCERT External Security Bulletin Redistribution ESB-2018.3463 Red Hat Virtualization security and bug fix update 6 November 2018 =========================================================================== AusCERT Security Bulletin Summary --------------------------------- Product: redhat-release-virtualization-host redhat-virtualization-host imgbased Publisher: Red Hat Operating System: Red Hat Enterprise Linux Server 7 Red Hat Enterprise Linux WS/Desktop 7 Impact/Access: Execute Arbitrary Code/Commands -- Existing Account Create Arbitrary Files -- Existing Account Denial of Service -- Existing Account Access Confidential Data -- Existing Account Resolution: Patch/Upgrade CVE Names: CVE-2018-14661 CVE-2018-14660 CVE-2018-14659 CVE-2018-14654 CVE-2018-14653 CVE-2018-14652 CVE-2018-10930 CVE-2018-10929 CVE-2018-10928 CVE-2018-10927 CVE-2018-10926 CVE-2018-10923 CVE-2018-10914 CVE-2018-10913 CVE-2018-10911 CVE-2018-10907 CVE-2018-10904 CVE-2018-10873 CVE-2018-10858 Reference: ESB-2018.3409 ESB-2018.3127 Original Bulletin: https://access.redhat.com/errata/RHSA-2018:3470 - --------------------------BEGIN INCLUDED TEXT-------------------- - -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: Red Hat Virtualization security and bug fix update Advisory ID: RHSA-2018:3470-01 Product: Red Hat Virtualization Advisory URL: https://access.redhat.com/errata/RHSA-2018:3470 Issue date: 2018-11-05 CVE Names: CVE-2018-10858 CVE-2018-10873 CVE-2018-10904 CVE-2018-10907 CVE-2018-10911 CVE-2018-10913 CVE-2018-10914 CVE-2018-10923 CVE-2018-10926 CVE-2018-10927 CVE-2018-10928 CVE-2018-10929 CVE-2018-10930 CVE-2018-14652 CVE-2018-14653 CVE-2018-14654 CVE-2018-14659 CVE-2018-14660 CVE-2018-14661 ===================================================================== 1. Summary: An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: RHEL 7-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64 Red Hat Virtualization 4 Hypervisor for RHEL 7 - noarch 3. Description: The redhat-virtualization-host packages provide the Red Hat Virtualization Host. These packages include redhat-release-virtualization-host, ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a special build of Red Hat Enterprise Linux with only the packages required to host virtual machines. RHVH features a Cockpit user interface for monitoring the host's resources and performing administrative tasks. Security Fix(es): * spice: Missing check in demarshal.py:write_validate_array_item() allows for buffer overflow and denial of service (CVE-2018-10873) * glusterfs: Multiple flaws (CVE-2018-10904, CVE-2018-10907, CVE-2018-10923, CVE-2018-10926, CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, CVE-2018-10911, CVE-2018-10914, CVE-2018-14652, CVE-2018-14653, CVE-2018-14654, CVE-2018-14659, CVE-2018-14660, CVE-2018-14661, CVE-2018-10913) * samba: Insufficient input validation in libsmbclient (CVE-2018-10858) For more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section. Red Hat would like to thank Michael Hanselmann (hansmi.ch) for reporting CVE-2018-10904, CVE-2018-10907, CVE-2018-10923, CVE-2018-10926, CVE-2018-10927, CVE-2018-10928, CVE-2018-10929, CVE-2018-10930, CVE-2018-10911, CVE-2018-10914, CVE-2018-14652, CVE-2018-14653, CVE-2018-14654, CVE-2018-14659, CVE-2018-14660, CVE-2018-14661, and CVE-2018-10913. The CVE-2018-10873 issue was discovered by Frediano Ziglio (Red Hat). Bug Fix(es): * When upgrading Red Hat Virtualization Host (RHVH), imgbased fails to run garbage collection on previous layers, so new logical volumes are removed, and the boot entry points to a logical volume that was removed. If the RHVH upgrade finishes successfully, the hypervisor boots successfully, even if garbage collection fails. (BZ#1632058) * During the upgrade process, when lvremove runs garbage collection, it prompts for user confirmation, causing the upgrade process to fail. Now the process uses "lvremove --force" when trying to remove logical volumes and does not fail even if garbage collection fails, and as a result, the upgrade process finishes successfully. (BZ#1632585) 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 5. Bugs fixed (https://bugzilla.redhat.com/): 1501276 - RHVH 4.2 should include RHGS 3.4 Batch #1 packages 1593731 - [downstream clone - 4.2.7] Rpm verify fails for newly installed libvirt-daemon-config-nwfilter package . 1596008 - CVE-2018-10873 spice: Missing check in demarshal.py:write_validate_array_item() allows for buffer overflow and denial of service 1601298 - CVE-2018-10904 glusterfs: Unsanitized file names in debug/io-stats translator can allow remote attackers to execute arbitrary code 1601642 - CVE-2018-10907 glusterfs: Stack-based buffer overflow in server-rpc-fops.c allows remote attackers to execute arbitrary code 1601657 - CVE-2018-10911 glusterfs: Improper deserialization in dict.c:dict_unserialize() can allow attackers to read arbitrary memory 1607617 - CVE-2018-10914 glusterfs: remote denial of service of gluster volumes via posix_get_file_contents function in posix-helpers.c 1607618 - CVE-2018-10913 glusterfs: Information Exposure in posix_get_file_contents function in posix-helpers.c 1610659 - CVE-2018-10923 glusterfs: I/O to arbitrary devices on storage server 1612658 - CVE-2018-10927 glusterfs: File status information leak and denial of service 1612659 - CVE-2018-10928 glusterfs: Improper resolution of symlinks allows for privilege escalation 1612660 - CVE-2018-10929 glusterfs: Arbitrary file creation on storage server allows for execution of arbitrary code 1612664 - CVE-2018-10930 glusterfs: Files can be renamed outside volume 1612805 - CVE-2018-10858 samba: Insufficient input validation in libsmbclient 1613143 - CVE-2018-10926 glusterfs: Device files can be created in arbitrary locations 1613231 - goferd errors in /var/log/messages of Red Hat Virtualization Host 1614971 - Upgrading RHV-H from 4.0.X to 4.2 is failing during migrate_var 1619590 - Rebase RHV-H on RHEL 7.6 1624453 - Host "hostname" moved to Non-Operational state as host does not meet the cluster's minimum CPU level. Missing CPU features : ssbd, spec_ctrl 1626960 - [el7.6]Network parameters IPv4/route/ovirtmgmt are missing during deploying Hosted-Engine 1631576 - CVE-2018-14654 glusterfs: "features/index" translator can create arbitrary, empty files 1632585 - lvremove command will fail if it asks for confirmation while removing old RHV-H layers 1632974 - CVE-2018-14652 glusterfs: Buffer overflow in "features/locks" translator allows for denial of service 1633431 - CVE-2018-14653 glusterfs: Heap-based buffer overflow via "gf_getspec_req" RPC message 1635926 - CVE-2018-14660 glusterfs: Repeat use of "GF_META_LOCK_KEY" xattr allows for memory exhaustion 1635929 - CVE-2018-14659 glusterfs: Unlimited file creation via "GF_XATTR_IOSTATS_DUMP_KEY" xattr allows for denial of service 1636880 - CVE-2018-14661 glusterfs: features/locks translator passes an user-controlled string to snprintf without a proper format string resulting in a denial of service 6. Package List: Red Hat Virtualization 4 Hypervisor for RHEL 7: Source: redhat-virtualization-host-4.2-20181026.0.el7_6.src.rpm noarch: redhat-virtualization-host-image-update-4.2-20181026.0.el7_6.noarch.rpm RHEL 7-based RHEV-H for RHEV 4 (build requirements): Source: imgbased-1.0.29-1.el7ev.src.rpm redhat-release-virtualization-host-4.2-7.3.el7.src.rpm noarch: imgbased-1.0.29-1.el7ev.noarch.rpm python-imgbased-1.0.29-1.el7ev.noarch.rpm redhat-virtualization-host-image-update-placeholder-4.2-7.3.el7.noarch.rpm x86_64: redhat-release-virtualization-host-4.2-7.3.el7.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2018-10858 https://access.redhat.com/security/cve/CVE-2018-10873 https://access.redhat.com/security/cve/CVE-2018-10904 https://access.redhat.com/security/cve/CVE-2018-10907 https://access.redhat.com/security/cve/CVE-2018-10911 https://access.redhat.com/security/cve/CVE-2018-10913 https://access.redhat.com/security/cve/CVE-2018-10914 https://access.redhat.com/security/cve/CVE-2018-10923 https://access.redhat.com/security/cve/CVE-2018-10926 https://access.redhat.com/security/cve/CVE-2018-10927 https://access.redhat.com/security/cve/CVE-2018-10928 https://access.redhat.com/security/cve/CVE-2018-10929 https://access.redhat.com/security/cve/CVE-2018-10930 https://access.redhat.com/security/cve/CVE-2018-14652 https://access.redhat.com/security/cve/CVE-2018-14653 https://access.redhat.com/security/cve/CVE-2018-14654 https://access.redhat.com/security/cve/CVE-2018-14659 https://access.redhat.com/security/cve/CVE-2018-14660 https://access.redhat.com/security/cve/CVE-2018-14661 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is <secalert@redhat.com>. More contact details at https://access.redhat.com/security/team/contact/ Copyright 2018 Red Hat, Inc. - -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBW+BbOtzjgjWX9erEAQgShRAAnQFJDf1gtnwIJzR/Gr3+PIsotOlGlxK7 ZOJlZoAbw8uFDqXxZfId0mdvJwGPbomEQQtxLd67Ftz10P41qNXLUVqM10sQzE/s thxWtralQylQ7/BZiYfnEvdD/CsScr6pp8EqA45wDAdAFkTm2avig5y0X8f1JrXJ f5jj3WWFpsmfKk0tnTwEyiYjHCchLz5WXA65PACv2xVCVFJnlBt81mhL5wmR8+vH 6whl+mIS7zKiL1XtobqZJKg5jgu21n3wxTCSSMxwAu6xtEaXnFSOQ2LWLjnn10IV q695+sJpOSPDb/iFJk3gtDqHqqAJaOloru0suIJgIDO4sjQ5DkOE6Y+y5RhA0Lmy vRUw4+c1rjHIxL9ZQr+4eeNlerkFdOeeb1BbV30rgqxwzOFec5ZDsuIf2867ioVT QZhwltg9U1mvAqod8dRMsImatw2g1pjLQ25VEniJXwy35F3b7wAV9clBXW4Y+gHV FEQNzAUG0v3VIYyRL95rRWWWg7UD+C3c7f58xrNRS5TjAc1RwEVWjvRP2EHWmm7T pipeyk+xOPkI8DirceZhducVFCKWvhWX3uBR0rNKRRueix7/i/jeqZyry7kc917C uYGZPyQbjM3TSm3RiC4AbC2En1fr/sXNHDNPPM/1A/tk/YW622XKrgQeTNsHswhM fMwXic2GWB4= =ww18 - -----END PGP SIGNATURE----- - --------------------------END INCLUDED TEXT-------------------- You have received this e-mail bulletin as a result of your organisation's registration with AusCERT. The mailing list you are subscribed to is maintained within your organisation, so if you do not wish to continue receiving these bulletins you should contact your local IT manager. If you do not know who that is, please send an email to auscert@auscert.org.au and we will forward your request to the appropriate person. NOTE: Third Party Rights This security bulletin is provided as a service to AusCERT's members. As AusCERT did not write the document quoted above, AusCERT has had no control over its content. The decision to follow or act on information or advice contained in this security bulletin is the responsibility of each user or organisation, and should be considered in accordance with your organisation's site policies and procedures. AusCERT takes no responsibility for consequences which may arise from following or acting on information or advice contained in this security bulletin. NOTE: This is only the original release of the security bulletin. It may not be updated when updates to the original are made. If downloading at a later date, it is recommended that the bulletin is retrieved directly from the author's website to ensure that the information is still current. Contact information for the authors of the original document is included in the Security Bulletin above. If you have any questions or need further information, please contact them directly. Previous advisories and external security bulletins can be retrieved from: https://www.auscert.org.au/bulletins/ =========================================================================== Australian Computer Emergency Response Team The University of Queensland Brisbane Qld 4072 Internet Email: auscert@auscert.org.au Facsimile: (07) 3365 7031 Telephone: (07) 3365 4417 (International: +61 7 3365 4417) AusCERT personnel answer during Queensland business hours which are GMT+10:00 (AEST). On call after hours for member emergencies only. =========================================================================== -----BEGIN PGP SIGNATURE----- Comment: http://www.auscert.org.au/render.html?it=1967 iQIVAwUBW+DlQGaOgq3Tt24GAQjX8xAAyXe/bxb2ep2Wx9ZL7xqqNK6Pz0FupP8a qE7WcI2PK1KPrGPmbwZv/Sezia/d5qfM7+JqopBwrsoJ7qmCmrQHJeMB656QqLUf omtxXd+7CxFkJN/x87COSZcyManI29K48UA64UvYN/WbOdwfod1FMxrvbd7YFr9U /FJISPjZQTQxhSswuGkxEcA1qsszBY9Kg3mDAc5kjGw20is8li1tv537m7e5tSMt zNRKrXfI5MvOIXjzM/uF+CzmDLM1aAVt5EKhtwfBy0r+nz7IOeX+Kr4ykTjThGiH qtRAHJgtaL/314im4EWuv1AlrBNyvVvVOwTbdH4fGUOCa83+uYFdEeq6xTDkoRe1 92YofaT1CjUXs+0PnMFv6CPW5pCZN+fOmLO/M14hu+h7KQ9lbRd90hd58tIwxcjX Io4lprKaCBpwd5GzA9Qmcpfshui+idlG2xZ6GiSJsqtVIStu/iAXcOo8a94oxCe7 EBClToxmOzgg+Fklu0Xe6cllkyAt4caUDnP6SIumNRp9g9vHcShyu2g140HU3grQ w9YkS7tAhHVHerzjGYzhzBQos+2REybKRCIndlT7zExr+R0rGWY9+W2hlWhwq2GR Vj0FehZHiKYFS8x66Dye/meeV1tWaPKBOfAyTI1fczGXZChxufT3/DBNthNsaYPs MpkUMxjpPwU= =7BJG -----END PGP SIGNATURE-----