Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.1] security, bug fix and update

Fixed packages 4

Vulnerabilities 9

• High 7.5
  CVE-2021-33623

  Uncontrolled Resource Consumption in trim-newlines

  The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

  trim-newlines node-trim-newlines node-trim-newlines Debian Ubuntu npm
  May 28, 2021
• High 7.5
  CVE-2021-35515 EPSS 12%

  Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

  When reading a specially crafted 7Z archive, the construction of the list of codecs that decompress an entry can result in an infinite loop. This could be used to mount a denial of service attack against services that use Compress' sevenz package.

  Apache Software Foundation Apache Commons Compress org.apache.commons:commons-compress libcommons-compress-java Debian Ubuntu Azure Linux Maven
  Jul 13, 2021
• High 7.5
  CVE-2021-35516 EPSS 12%

  Apache Commons Compress 1.6 to 1.20 denial of service vulnerability

  When reading a specially crafted 7Z archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Com…

  Apache Software Foundation Apache Commons Compress libcommons-compress-java org.apache.commons:commons-compress Debian Ubuntu Azure Linux Maven
  Jul 13, 2021
• High 7.5
  CVE-2021-35517 EPSS 11%

  Apache Commons Compress 1.1 to 1.20 denial of service vulnerability

  When reading a specially crafted TAR archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Co…

  Apache Software Foundation Apache Commons Compress org.apache.commons:commons-compress libcommons-compress-java Debian Ubuntu Azure Linux Maven
  Jul 13, 2021
• High 7.5
  CVE-2021-36090 EPSS 13%

  Apache Commons Compress 1.0 to 1.20 denial of service vulnerability

  When reading a specially crafted ZIP archive, Compress can be made to allocate large amounts of memory that finally leads to an out of memory error even for very small inputs. This could be used to mount a denial of service attack against services that use Co…

  Apache Software Foundation Apache Commons Compress org.apache.commons:commons-compress libcommons-compress-java Debian Ubuntu Azure Linux Maven
  Jul 13, 2021
• High 7.5
  CVE-2021-3807

  Inefficient Regular Expression Complexity in chalk/ansi-regex

  ansi-regex is vulnerable to Inefficient Regular Expression Complexity

  chalk chalk/ansi-regex node-ansi-regex ansi-regex Debian Ubuntu npm
  Sep 17, 2021
• Medium 6.5
  CVE-2022-22950 EPSS 37%

  Allocation of Resources Without Limits or Throttling in Spring Framework

  n Spring Framework versions 5.3.0 - 5.3.16 and older unsupported versions, it is possible for a user to provide a specially crafted SpEL expression that may cause a denial of service condition.

  libspring-java libspring-java org.springframework:spring-expression Debian Ubuntu Maven
  Apr 1, 2022
• Medium 4.4
  CVE-2022-31051

  Exposure of Sensitive Information to an Unauthorized Actor in semantic-release

  semantic-release is an open source npm package for automated version management and package publishing. In affected versions secrets that would normally be masked by semantic-release can be accidentally disclosed if they contain characters that are excluded f…

  semantic-release semantic-release semantic-release npm
  Jun 9, 2022
• Medium 4.3
  CVE-2021-22096

  Improper Output Neutralization for Logs in Spring Framework

  In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

  libspring-java libspring-java org.springframework:spring-core org.springframework:spring Debian Ubuntu Maven
  Oct 28, 2021

References

• article
  https://access.redhat.com/documentation/en-us/red_hat_virtualization/4.4/html-single/technical_notes
• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1663217
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1782077
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1849045
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1852308
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1958032
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1966615
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1976607
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1981895
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1981900
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1981903
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1981909
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1994144
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2001574
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2001923
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2006625
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2007557
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2030293
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2068270
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2069414
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2070045
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2072626
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2081241
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2081559
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2089856
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092885
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2093795
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2097414
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2099650
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2105296
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_5555.json
• report
  https://access.redhat.com/security/cve/CVE-2021-3807
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-3807
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-3807
• article
  https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994
• report
  https://access.redhat.com/security/cve/CVE-2021-22096
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034584
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-22096