Red Hat Security Advisory: Red Hat Virtualization security, bug fix, and enhancement update
An update for imgbased, redhat-release-virtualization-host, and redhat-virtualization-host is now available for Red Hat Virtualization 4 for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2020-1730US | medium5.3 | — | ||
A flaw was found in libssh versions before 0.8.9 and before 0.9.4 in the way it handled AES-CTR (or DES ciphers if enabled) ciphers. The server or client could crash when the conne… | ||||
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- https://access.redhat.com/errata/RHSA-2020:5218self
- https://access.redhat.com/security/updates/classification/#moderateexternal
- 1801998external
- 1833254external
- 1868293external
- 1886484external
- 1886647external
- 1886695external
Behebungen (10)
- Behobenredhat-virtualization-host-0:4.4.3-20201116.0.el8_3.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891
https://access.redhat.com/errata/RHSA-2020:5218 - Behobenredhat-virtualization-host-image-update-0:4.4.3-20201116.0.el8_3.noarch as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891
https://access.redhat.com/errata/RHSA-2020:5218 - Workaroundimgbased-0:1.2.13-0.1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundimgbased-0:1.2.13-0.1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundpython3-imgbased-0:1.2.13-0.1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundredhat-release-virtualization-host-0:4.4.3-1.el8ev.src as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundredhat-release-virtualization-host-0:4.4.3-1.el8ev.x86_64 as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundredhat-virtualization-host-0:4.4.3-20201116.0.el8_3.src as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundredhat-virtualization-host-image-update-0:4.4.3-20201116.0.el8_3.noarch as a component of Red Hat Virtualization 4 Hypervisor for RHEL 8
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
- Workaroundredhat-virtualization-host-image-update-placeholder-0:4.4.3-1.el8ev.noarch as a component of RHEL 8-based RHEV-H for RHEV 4 (build requirements)
Disable AES-CTR ciphers (and DES in libssh 0.8). If you implement a server using libssh we advise to use a prefork model so each session runs in an own process. If you have implemented your server this way this is not really an issue. The client will kill its own connection.
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan