Red Hat Security Advisory: ovirt-web-ui security and bug fix update

Fixed packages 1

Vulnerabilities 3

• Critical 9.1
  CVE-2019-10744 Public exploit

  Prototype Pollution in lodash

  Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

  snyk lodash js-jquery lodash Debian Azure Linux npm RubyGems
  Jul 25, 2019
• Medium 6.1
  CVE-2019-11358 Public exploit EPSS 87%

  XSS in jQuery as used in Drupal, Backdrop CMS, and other products

  jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Obj…

  mediawiki mediawiki django drupal/core Debian Ubuntu Azure Linux Alpine npm Packagist Maven PyPI NuGet RubyGems
  Apr 19, 2019
• Medium 6.1
  CVE-2019-8331 Public exploit EPSS 16%

  Bootstrap Vulnerable to Cross-Site Scripting

  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

  ceph fluent-bit pytorch ntopng Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems
  Feb 20, 2019

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1686454
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1701972
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1739497
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_3024.json
• report
  https://access.redhat.com/security/cve/CVE-2019-8331
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-8331
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-8331
• report
  https://access.redhat.com/security/cve/CVE-2019-10744
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-10744
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-10744
• report
  https://access.redhat.com/security/cve/CVE-2019-11358
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-11358
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-11358
• article
  https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/
• article
  https://www.drupal.org/sa-core-2019-006