Skip to content
OpenAdvisories
Critical RHSA-2018:1525 6 CVEs

Red Hat Security Advisory: rhvm-appliance security and enhancement update

Published Sep 18, 2024 · Updated Aug 9, 2026

Ecosystem: Red Hat

Fixed packages 1

ReleasePackageFixed in
Red Hat · RHEL 7 enterprise_linux:7::hypervisor rhvm-appliance 2:4.2-20180504.0.el7

Vulnerabilities 6

  • Critical 9.8
    CVE-2018-7750 Public exploit EPSS 27%

    Paramiko not properly checking authentication before processing other requests

    transport.py in the SSH server implementation of Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed b…

    paramiko paramiko paramiko py3-paramiko Debian Ubuntu Alpine PyPI
  • Critical 9.8
    CVE-2018-8088 EPSS 15%

    Improper Access Control in SLF4J

    org.slf4j.ext.EventData in the slf4j-ext module in QOS.CH SLF4J before 1.8.0-beta2 allows remote attackers to bypass intended access restrictions via crafted data. EventData in the slf4j-ext module in QOS.CH SLF4J, has been fixed in SLF4J versions 1.7.26 late…

    org.slf4j:slf4j-ext libslf4j-java Debian Maven
  • High 8.1
    CVE-2018-5968

    Deserialization of Untrusted Data in jackson-databind

    FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypa…

    com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  • High 7.5
    CVE-2018-1111 Public exploit EPSS 98%

    DHCP packages in Red Hat Enterprise Linux 6 and 7, Fedora 28, and earlier are vulnerable to a command injection flaw in…

    Red Hat Fedora dhcp dhcp
  • Medium 5.3
    CVE-2018-1073

    The web console login form in ovirt-engine before version 4.2.3 returned different errors for non-existent users and in…

    [UNKNOWN] ovirt-engine
  • Medium 4.8
    CVE-2017-12196

    Incorrect Authorization in Undertow

    undertow before versions 1.4.18.SP1, 2.0.2.Final, 1.4.24.Final was found vulnerable when using Digest authentication, the server does not ensure that the value of URI in the Authorization header matches the URI in HTTP request line. This allows the attacker t…

    undertow undertow io.undertow:undertow-core Debian Ubuntu Maven

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1422982
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1463853
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1464486
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1467946
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1476755
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1503055
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1538332
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1548909
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1553525
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1557130
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1561888
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1563737
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2018/rhsa-2018_1525.json
  • report
    https://access.redhat.com/security/cve/CVE-2017-12196
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2017-12196
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2017-12196
  • report
    https://access.redhat.com/security/cve/CVE-2018-1073
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1073
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1073
  • report
    https://access.redhat.com/security/cve/CVE-2018-1111
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1567974
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-1111
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-1111
  • article
    https://access.redhat.com/security/vulnerabilities/3442151
  • report
    https://access.redhat.com/security/cve/CVE-2018-5968
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-5968
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-5968
  • report
    https://access.redhat.com/security/cve/CVE-2018-7750
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-7750
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-7750
  • report
    https://access.redhat.com/security/cve/CVE-2018-8088
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2018-8088
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2018-8088