Red Hat Security Advisory: Red Hat Virtualization Host security and bug fix update [ovirt-4.4.8]

Fixed packages 2

Vulnerabilities 2

• High 7.2
  CVE-2021-23337 Public exploit Scanner template EPSS 20%

  Command Injection

  Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

  js-jquery lodash node-lodash node-lodash Debian Ubuntu Azure Linux npm RubyGems
  Feb 15, 2021
• Medium 5.3
  CVE-2020-28500

  Regular Expression Denial of Service (ReDoS)

  Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

  js-jquery lodash node-lodash node-lodash Debian Ubuntu Azure Linux npm RubyGems
  Feb 15, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1928937
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1928954
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1948177
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1959436
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1984209
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1998017
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_3459.json
• report
  https://access.redhat.com/security/cve/CVE-2020-28500
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-28500
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-28500
• article
  https://snyk.io/vuln/SNYK-JS-LODASH-1018905
• report
  https://access.redhat.com/security/cve/CVE-2021-23337
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23337
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23337
• article
  https://snyk.io/vuln/SNYK-JS-LODASH-1040724