Red Hat Security Advisory: RHV Manager (ovirt-engine) security update [ovirt-4.4.7]

Fixed packages 1

Vulnerabilities 4

• High 7.5
  CVE-2020-7733

  Regular Expression Denial of Service (ReDoS)

  The package ua-parser-js before 0.7.22 are vulnerable to Regular Expression Denial of Service (ReDoS) via the regex for Redmi Phones and Mi Pad Tablets UA.

  ua-parser-js node-ua-parser-js Ubuntu npm
  Sep 16, 2020
• Medium 5.3
  CVE-2020-28469

  Regular Expression Denial of Service (ReDoS)

  This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

  js-jquery nodejs-nodemon glob-parent node-glob-parent Debian Azure Linux npm
  Jun 3, 2021
• Medium 5.3
  CVE-2021-23343

  Regular Expression Denial of Service (ReDoS)

  All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

  path-parse npm
  May 4, 2021
• Low 3.3
  CVE-2021-23358 Public exploit

  Arbitrary Code Injection

  The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

  js-jquery underscore underscore underscore Debian Ubuntu Azure Linux npm
  Mar 29, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1752996
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1765644
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1779983
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1804774
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1817346
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1877478
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1879733
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1887434
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1888354
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1896359
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1901011
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1902179
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1937714
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1939198
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1941581
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1944286
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1945459
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1946876
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1951579
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1954878
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1955582
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1956818
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1960968
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1961338
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1967169
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1970718
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_2865.json
• report
  https://access.redhat.com/security/cve/CVE-2020-7733
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-7733
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-7733
• article
  https://snyk.io/vuln/SNYK-JS-UAPARSERJS-610226
• report
  https://access.redhat.com/security/cve/CVE-2020-28469
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28469
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28469
• article
  https://snyk.io/vuln/SNYK-JS-GLOBPARENT-1016905
• report
  https://access.redhat.com/security/cve/CVE-2021-23343
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23343
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23343