Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update [ovirt-4.5.0]

Fixed packages 2

Vulnerabilities 7

• High 8.8
  CVE-2022-1271

  An arbitrary file write vulnerability was found in GNU gzip's zgrep utility. When zgrep is applied on the attacker's ch…

  gzip xz-utils xz gzip Debian Ubuntu Azure Linux Alpine
  Aug 31, 2022
• High 8.1
  CVE-2022-24903 Public exploit

  Buffer overflow in TCP syslog server (receiver) components in rsyslog

  Rsyslog is a rocket-fast system for log processing. Modules for TCP syslog reception have a potential heap buffer overflow when octet-counted framing is used. This can result in a segfault or some other malfunction. As of our understanding, this vulnerability…

  rsyslog rsyslog rsyslog rsyslog Debian Ubuntu Azure Linux Alpine
  May 5, 2022
• High 7.5
  CVE-2018-25032 Public exploit EPSS 52%

  Nokogiri affected by zlib's Out-of-bounds Write vulnerability

  zlib before 1.2.12 allows memory corruption when deflating (i.e., when compressing) if the input has many distant matches.

  mariadb-10.3 mariadb-10.6 mariadb openjpeg2 Debian Ubuntu Azure Linux Alpine Wolfi RubyGems
  Mar 25, 2022
• High 7.5
  CVE-2022-0778 Public exploit EPSS 73%

  Infinite loop in BN_mod_sqrt() reachable when parsing certificates

  The BN_mod_sqrt() function, which computes a modular square root, contains a bug that can cause it to loop forever for non-prime moduli. Internally this function is used when parsing certificates that contain elliptic curve public keys in compressed form or e…

  OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine crates.io
  Mar 15, 2022
• Unscored —
  CVE-2021-4028

  A flaw in the Linux kernel's implementation of RDMA communications manager listener code allowed an attacker with local…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Aug 24, 2022
• Unscored —
  CVE-2021-4083

  A read-after-free memory flaw was found in the Linux kernel's garbage collection for Unix domain socket file handlers i…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Jan 18, 2022
• Unscored —
  CVE-2022-25636 Public exploit

  net/netfilter/nf_dup_netdev.c in the Linux kernel 5.4 through 5.6.10 allows local users to gain privileges because of a…

  linux-raspi2 linux-hwe linux-azure linux-riscv Debian Ubuntu
  Feb 22, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1899821
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1997074
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2020497
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2027201
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2029923
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2038081
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2052963
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2056334
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2056745
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2056830
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2057338
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2057342
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2062202
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2067945
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2073310
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2081353
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2086834
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2090138
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_4896.json
• report
  https://access.redhat.com/security/cve/CVE-2018-25032
• advisory
  https://www.cve.org/CVERecord?id=CVE-2018-25032
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2018-25032
• report
  https://access.redhat.com/security/cve/CVE-2021-4028
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-4028
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-4028
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=bc0bdc5afaa74
• article
  https://lkml.org/lkml/2021/10/4/697
• report
  https://access.redhat.com/security/cve/CVE-2021-4083
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-4083
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-4083
• article
  https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=054aa8d439b9
• report
  https://access.redhat.com/security/cve/CVE-2022-0778
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-0778
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-0778
• article
  https://www.openssl.org/news/secadv/20220315.txt
• report
  https://access.redhat.com/security/cve/CVE-2022-1271
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-1271
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-1271