Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4.z [ovirt-4.4.5] 0-day security, bug fix, enhance

Fixed packages 1

Vulnerabilities 2

• High 7.3
  CVE-2020-28458 Public exploit

  Prototype Pollution

  All versions of package datatables.net are vulnerable to Prototype Pollution due to an incomplete fix for https://snyk.io/vuln/SNYK-JS-DATATABLESNET-598806.

  reaper datatables.net Azure Linux npm
  Dec 16, 2020
• Medium 6.1
  CVE-2019-20921

  Cross-site scripting in bootstrap-select

  bootstrap-select before 1.13.6 allows Cross-Site Scripting (XSS). It does not escape title values in OPTION elements. This may allow attackers to execute arbitrary JavaScript in a victim's browser.

  bootstrap-select bootstrap-select npm NuGet
  Sep 30, 2020

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• article
  https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1171924
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1750426
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1795457
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1882273
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1908441
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1920539
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1186.json
• report
  https://access.redhat.com/security/cve/CVE-2019-20921
• advisory
  https://www.cve.org/CVERecord?id=CVE-2019-20921
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2019-20921
• advisory
  https://github.com/advisories/GHSA-9r7h-6639-v5mw
• article
  https://snyk.io/vuln/SNYK-JS-BOOTSTRAPSELECT-570457
• report
  https://access.redhat.com/security/cve/CVE-2020-28458
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28458
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28458
• article
  https://snyk.io/vuln/SNYK-JS-DATATABLESNET-1016402