Red Hat Security Advisory: RHV-M(ovirt-engine) 4.4.z security, bug fix, enhancement update [ovirt-4.4.4]

Fixed packages 26

Vulnerabilities 1

• High 7.5
  CVE-2020-25649 EPSS 18%

  XML External Entity (XXE) Injection in Jackson Databind

  A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly. This flaw allows vulnerability to XML external entity (XXE) attacks. The highest threat from this vulnerability is data integrity.

  com.fasterxml.jackson.core:jackson-databind jackson-databind jackson-databind Debian Ubuntu Maven
  Dec 3, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#low
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1627997
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1702237
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1796231
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1868114
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1875951
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1879655
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1880015
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1881115
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1881357
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1887664
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1893035
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1894298
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1901946
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1903385
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1903595
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0381.json
• report
  https://access.redhat.com/security/cve/CVE-2020-25649
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25649
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25649
• article
  https://github.com/FasterXML/jackson-databind/issues/2589