Red Hat Security Advisory: RHV Manager (ovirt-engine) [ovirt-4.5.2] bug fix and security update

Fixed packages 23

Vulnerabilities 6

• Medium 6.9
  CVE-2020-11023 Exploited Public exploit EPSS 85%

  Potential XSS vulnerability in jQuery

  In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute unt…

  jquery jQuery drupal7 cacti Debian Ubuntu Alpine npm Packagist Maven NuGet RubyGems
  Apr 29, 2020

  KEV Jan 23, 2025
• High 7.5
  CVE-2022-31129

  Inefficient Regular Expression Complexity in moment

  moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 par…

  moment moment mediawiki wordpress Debian Ubuntu npm NuGet
  Jul 6, 2022
• Medium 6.9
  CVE-2020-11022 Public exploit EPSS 99%

  jQuery has a potential XSS vulnerability

  In jQuery starting with 1.12.0 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3…

  jquery jQuery keycloak-26.6-iamguarded-compat drupal7 Debian Ubuntu Alpine Wolfi npm Packagist Maven NuGet RubyGems
  Apr 29, 2020
• Medium 5.5
  CVE-2022-2806

  sosreport Exposure of Sensitive Information vulnerability

  It was found that the ovirt-log-collector/sosreport collects the RHV admin password unfiltered. Fixed in: sos-4.2-20.el8_6, ovirt-log-collector-4.4.7-2.el8ev

  sosreport sosreport sos Ubuntu Azure Linux PyPI
  Sep 1, 2022
• Medium 4.3
  CVE-2021-22096

  Improper Output Neutralization for Logs in Spring Framework

  In Spring Framework versions 5.3.0 - 5.3.10, 5.2.0 - 5.2.17, and older unsupported versions, it is possible for a user to provide malicious input to cause the insertion of additional log entries.

  libspring-java libspring-java org.springframework:spring-core org.springframework:spring Debian Ubuntu Maven
  Oct 28, 2021
• Low 3.3
  CVE-2021-23358 Public exploit

  Arbitrary Code Injection

  The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

  js-jquery underscore underscore underscore Debian Ubuntu Azure Linux npm
  Mar 29, 2021

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1828406
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1850004
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1939284
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1944286
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1955388
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=1974974
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2034584
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2080005
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2092478
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2094577
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2097536
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2097558
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2097560
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2097725
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2104115
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2104831
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2104939
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2105075
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107250
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2107267
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2108985
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2109923
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_6393.json
• report
  https://access.redhat.com/security/cve/CVE-2020-11022
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-11022
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-11022
• advisory
  https://github.com/advisories/GHSA-gxr4-xjj5-5px2
• report
  https://access.redhat.com/security/cve/CVE-2020-11023
• advisory
  https://www.cve.org/CVERecord?id=CVE-2020-11023
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2020-11023
• article
  https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
• article
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• report
  https://access.redhat.com/security/cve/CVE-2021-22096
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-22096
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-22096
• report
  https://access.redhat.com/security/cve/CVE-2021-23358
• advisory
  https://www.cve.org/CVERecord?id=CVE-2021-23358
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2021-23358