Red Hat Security Advisory: Red Hat Virtualization Host security update [ovirt-4.4.6]

Fixed packages 2

Vulnerabilities 3

• Critical 9.1
  CVE-2020-36242

  PyCA Cryptography symmetrically encrypting large values can lead to integer overflow

  In the cryptography package before 3.3.2 for Python, certain sequences of update calls to symmetrically encrypt multi-GB values could result in an integer overflow and buffer overflow, as demonstrated by the Fernet class.

  cryptography python-cryptography py3-cryptography Debian Alpine PyPI
  Feb 7, 2021
• High 7.5
  CVE-2020-28196

  MIT Kerberos 5 (aka krb5) before 1.17.2 and 1.18.x before 1.18.3 allows unbounded recursion via an ASN.1-encoded Kerber…

  krb5 krb5 krb5 Debian Ubuntu Alpine
  Nov 6, 2020
• Medium 5.9
  CVE-2020-25659

  RSA decryption vulnerable to Bleichenbacher timing vulnerability

  python-cryptography 3.2 is vulnerable to Bleichenbacher timing attacks in the RSA decryption API, via timed processing of valid PKCS#1 v1.5 ciphertext.

  cryptography python-cryptography python-cryptography py3-cryptography Debian Ubuntu Alpine PyPI
  Jan 11, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1779052
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1882542
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1889988
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1897893
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1901041
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1901878
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1909888
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1926226
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1931443
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1936972
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1938925
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1942580
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1944632
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1946095
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1948944
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1949431
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1957604
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2239.json
• report
  https://access.redhat.com/security/cve/CVE-2020-25659
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-25659
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-25659
• article
  https://cryptography.io/en/latest/changelog.html#v3-2
• report
  https://access.redhat.com/security/cve/CVE-2020-28196
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28196
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28196
• report
  https://access.redhat.com/security/cve/CVE-2020-36242
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-36242
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-36242
• article
  https://cryptography.io/en/latest/changelog.html#v3-3-2