Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update
An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-1730US | medium5.3 | — | ||
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the conne… | ||||
references
External citations — patches, advisories, analysis.
- https://access.redhat.com/errata/RHSA-2020:5218self
- https://access.redhat.com/security/updates/classification/#moderateexternal
- 1801998external
- 1833254external
- 1868293external
- 1886484external
- 1886647external
- 1886695external
remediations (10)
- Fixedredhat-virtualization-host-0:4.4.3-20201116.0.el8_3.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891
https://access.redhat.com/errata/RHSA-2020:5218 - Fixedredhat-virtualization-host-image-update-0:4.4.3-20201116.0.el8_3.noarch as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891
https://access.redhat.com/errata/RHSA-2020:5218 - Workaroundimgbased-0:1.2.13-0.1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundimgbased-0:1.2.13-0.1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundpython3-imgbased-0:1.2.13-0.1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundredhat-release-virtualization-host-0:4.4.3-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundredhat-release-virtualization-host-0:4.4.3-1.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundredhat-virtualization-host-0:4.4.3-20201116.0.el8_3.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundredhat-virtualization-host-image-update-0:4.4.3-20201116.0.el8_3.noarch as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundredhat-virtualization-host-image-update-placeholder-0:4.4.3-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan