Red Hat Security Advisory: Red Hat Virtualization security update

Fixed packages 9

Vulnerabilities 6

• Critical 9.8
  CVE-2019-10160

  A security regression of CVE-2019-9636 was discovered in python since commit d537ab0ff9767ef024f26246899728f0116b1ec3 a…

  Python python python3.4 python3.5 Debian Ubuntu
  Jun 7, 2019
• Medium 5.6
  CVE-2019-10139

  During HE deployment via cockpit-ovirt, cockpit-ovirt generates an ansible variable file `/var/lib/ovirt-hosted-engine-…

  ovirt cockpit-ovirt
  May 17, 2019
• Medium 5.4
  CVE-2018-16838

  A flaw was found in sssd Group Policy Objects implementation. When the GPO is not readable by SSSD due to a too strict …

  [UNKNOWN] sssd sssd sssd Debian Ubuntu
  Mar 25, 2019
• Medium 5.3
  CVE-2018-16881

  A denial of service vulnerability was found in rsyslog in the imptcp module. An attacker could send a specially crafted…

  The rsyslog Project rsyslog: rsyslog rsyslog Debian Ubuntu
  Jan 25, 2019
• Unscored —
  CVE-2019-0161

  Stack overflow in XHCI for EDK II may allow an unauthenticated user to potentially enable denial of service via local a…

  Extensible Firmware Interface Development Kit (EDK II) Extensible Firmware Interface Development Kit (EDK II) edk2 edk2 Debian Ubuntu
  Mar 27, 2019
• Unscored —
  CVE-2019-1559 EPSS 17%

  0-byte record padding oracle

  If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify, and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding …

  OpenSSL OpenSSL openssl openssl Debian Ubuntu Alpine
  Feb 27, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1640820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1658366
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1683804
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1687920
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1694065
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1702223
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1709829
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1718388
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720156
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720160
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720435
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1720436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1724044
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1726534
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1727007
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1727859
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1728998
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1729023
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_2437.json
• report
  https://access.redhat.com/security/cve/CVE-2018-16838
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16838
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16838
• report
  https://access.redhat.com/security/cve/CVE-2018-16881
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-16881
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-16881
• report
  https://access.redhat.com/security/cve/CVE-2019-0161
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-0161
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-0161
• article
  https://edk2-docs.gitbooks.io/security-advisory/content/xhci-stack-local-stack-overflow.html
• report
  https://access.redhat.com/security/cve/CVE-2019-1559
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-1559
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-1559
• article
  https://github.com/RUB-NDS/TLS-Padding-Oracles
• article
  https://www.openssl.org/news/secadv/20190226.txt
• report
  https://access.redhat.com/security/cve/CVE-2019-10139
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10139