Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update

Fixed packages 24

Vulnerabilities 8

• Medium 6.9
  CVE-2020-11023 Exploited Public exploit EPSS 85%

  Potential XSS vulnerability in jQuery

  In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

  jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems
  Apr 29, 2020

  KEV Jan 23, 2025
• Critical 9.8
  CVE-2019-13990 Public exploit EPSS 17%

  XML external entity injection in Terracotta Quartz Scheduler

  initDocumentParser in xml/XMLSchedulingDataProcessor.java in Terracotta Quartz Scheduler through 2.3.0 allows XXE attacks via a job description.

  org.quartz-scheduler:quartz libquartz-java libquartz2-java libquartz2-java Debian Ubuntu Maven
  Jul 26, 2019
• Medium 6.9
  CVE-2020-11022 Public exploit EPSS 99%

  jQuery has a potential XSS vulnerability

  In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…

  jquery jQuery keycloak-26.6-iamguarded-compat drupal7 Debian Ubuntu Alpine Wolfi npm Packagist Maven NuGet RubyGems
  Apr 29, 2020
• Medium 6.1
  CVE-2017-18635 Public exploit

  Cross-Site Scripting in @novnc/novnc

  An XSS vulnerability was discovered in noVNC before 0.6.2 in which the remote VNC server could inject arbitrary HTML into the noVNC web page via the messages propagated to the status field, such as the VNC server name.

  novnc @novnc/novnc novnc Debian Ubuntu npm
  Sep 25, 2019
• Medium 6.1
  CVE-2019-8331 Public exploit EPSS 16%

  Bootstrap Vulnerable to Cross-Site Scripting

  In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

  ceph fluent-bit pytorch ntopng Debian Ubuntu Azure Linux npm Packagist Maven NuGet RubyGems
  Feb 20, 2019
• Medium 5.6
  CVE-2020-7598 Public exploit

  Prototype Pollution in minimist

  minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

  js-jquery nodejs-nodemon node-minimist minimist Debian Ubuntu Azure Linux npm
  Mar 11, 2020
• Medium 5.4
  CVE-2019-19336

  A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3…

  Red Hat ovirt-engine
  Mar 19, 2020
• Unscored —
  CVE-2020-10775

  An Open redirect vulnerability was found in ovirt-engine versions 4.4 and earlier, where it allows remote attackers to …

  Aug 24, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#important
• article
  https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.3/html-single/technical_notes
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1080097
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1325468
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1358501
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1427717
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1475774
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1507438
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1523835
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1527843
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1529042
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1535796
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1546838
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1547937
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1585986
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1593800
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1596178
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1600059
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1610212
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1611395
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1616451
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1637172
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1640908
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1642273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1647440
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1648345
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1650417
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1650505
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1651406
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1651939
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1654069
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1654889
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1656621
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1658101
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1659161
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1660071
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1660644
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1663366
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1664479