Description
A cross-site scripting vulnerability was reported in the oVirt-engine's OAuth authorization endpoint before version 4.3.8. URL parameters were included in the HTML response without escaping. This flaw would allow an attacker to craft malicious HTML pages that can run scripts in the context of the user's oVirt session.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Red Hat | ovirt-engine | 4.3.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhev Manager 4 | novnc | 1.1.0-1.el8ost | RHSA-2020:3247 |
| Red Hat Rhev Manager 4 | ovirt-engine-api-explorer | 0.0.6-1.el8ev | RHSA-2020:3247 |
| Red Hat Rhev Manager 4 | ovirt-engine-dwh +1 | 4.3.8-1.el7ev | RHSA-2020:0498 |
| Red Hat Rhev Manager 4 | ovirt-engine-metrics | 1.3.6.2-1.el7ev | RHSA-2020:0498 |
| Red Hat Rhev Manager 4 | ovirt-engine-ui-extensions | 1.2.2-1.el8ev | RHSA-2020:3247 |
| Red Hat Rhev Manager 4 | ovirt-fast-forward-upgrade | 1.0.0-16.el7ev | RHSA-2020:0498 |
| Red Hat Rhev Manager 4 | ovirt-imageio-proxy +2 | 1.5.3-0.el7ev | RHSA-2020:0498 |
| Red Hat Rhev Manager 4 | ovirt-web-ui | 1.6.0-2.el7ev | RHSA-2020:0498 |
| Red Hat Rhev Manager 4 | python3-ovirt-engine-lib +1 | 4.4.1.8-0.7.el8ev | RHSA-2020:3247 |
| Red Hat Rhev Manager 4 | rhv-log-collector-analyzer | 0.2.15-0.el7ev | RHSA-2020:0498 |
| Red Hat Rhev Manager 4 | rhvm +20 | 4.3.8.2-0.4.el7 | RHSA-2020:3247, RHSA-2020:0498 |
| Red Hat Rhev Manager 4 | rhvm-dependencies | 4.4.0-1.el8ev | RHSA-2020:3247 |
| Red Hat Rhev Manager 4 | v2v-conversion-host +1 | 1.16.0-3.el7ev | RHSA-2020:0498 |
Advisories 2
- RHSA-2020:3247 Red Hat Security Advisory: RHV Manager (ovirt-engine) 4.4 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2020:0498 Red Hat Security Advisory: Red Hat Virtualization Engine security, bug fix and enhancement update Red Hat Security Advisories (RHSA) · Feb 21, 2026