Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] security, bug fix, enhancement

Fixed packages 21

Vulnerabilities 4

• High 7.5
  CVE-2020-28477

  Prototype Pollution

  This affects all versions of package immer.

  immer npm
  Jan 19, 2021
• High 7.3
  CVE-2020-28458 Public exploit

  Prototype Pollution

  All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

  reaper datatables.net Azure Linux npm
  Dec 16, 2020
• Medium 6.1
  CVE-2019-20921

  Cross-site scripting in bootstrap-select

  bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

  bootstrap-select bootstrap-select npm NuGet
  Sep 30, 2020
• Unscored —
  CVE-2020-25657

  A flaw was found in all released versions of m2crypto, where they are vulnerable to Bleichenbacher timing attacks in th…

  m2crypto m2crypto m2crypto Debian Ubuntu Azure Linux
  Jan 12, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1145658
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1155275
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1649479
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1666786
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1688186
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1729359
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1787235
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1802844
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1837221
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1843882
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1858420
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1882273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1884233
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1889823
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1895217
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1901503
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1901752
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1905108
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1905158
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1908441
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1910302
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1913198
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1914602
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1918162
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1919555
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1921104
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1921119
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1922200
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1924012
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1926854
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1927851
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1931514
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1931786
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1169.json
• report
  https://access.redhat.com/security/cve/CVE-2019-20921
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-20921
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-20921