-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: Red Hat Virtualization security, bug fix, and enhancement update
Advisory ID:       RHSA-2021:1189-01
Product:           Red Hat Virtualization
Advisory URL:      https://access.redhat.com/errata/RHSA-2021:1189
Issue date:        2021-04-14
CVE Names:         CVE-2021-3449 CVE-2021-3450 
=====================================================================

1. Summary:

An update is now available for Red Hat Virtualization 4 for Red Hat
Enterprise Linux 8.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

RHEL 8-based RHEV-H for RHEV 4 (build requirements) - noarch, x86_64
Red Hat Virtualization 4 Hypervisor for RHEL 8 - noarch, x86_64

3. Description:

The redhat-virtualization-host packages provide the Red Hat Virtualization
Host. These packages include redhat-release-virtualization-host,
ovirt-node, and rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are
installed using a special build of Red Hat Enterprise Linux with only the
packages required to host virtual machines. RHVH features a Cockpit user
interface for monitoring the host's resources and performing administrative
tasks.

The ovirt-node-ng packages provide the Red Hat Virtualization Host. These
packages include redhat-release-virtualization-host, ovirt-node, and
rhev-hypervisor. Red Hat Virtualization Hosts (RHVH) are installed using a
special build of Red Hat Enterprise Linux with only the packages required
to host virtual machines. RHVH features a Cockpit user interface for
monitoring the host's resources and performing administrative tasks.

Changes to the redhat-release-virtualization-host component:

* Previously, the redhat-support-tool was missing from the RHV-H 4.4
package. 
In this release, the redhat-support-tool has been added. (BZ#1928607)

Security Fix(es):

* openssl: NULL pointer dereference in signature_algorithms processing
(CVE-2021-3449)

* openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT
(CVE-2021-3450)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/2974891

The system must be rebooted for this update to take effect. For the update
to take effect, all services linked to the glibc library must be restarted,
or the system rebooted.

5. Bugs fixed (https://bugzilla.redhat.com/):

1892573 - RHVH 4.4.2 fails to boot from SAN when using UUID for /boot partition
1895832 - RHVH 4.4.3: No response when clicking button "Help" in Anaconda GUI
1907306 - "sysstat" doesn't collect data for upgraded RHVH
1907358 - In FIPS mode, RHVH cannot enter the new layer after upgrade
1907746 - RHVH cannot enter the new layer after upgrade testing with STIG profile selected.
1918207 - RHVH upgrade to 4.4.5-1 will fail due to FileNotFoundError
1927395 - RHVH, protecting key packages from being removed.
1928607 - redhat-support-tool is missing from latest RHV-H 4.4
1940845 - Include updated gluster-ansible-features in RHV-H 4.4.5
1941547 - CVE-2021-3450 openssl: CA certificate check bypass with X509_V_FLAG_X509_STRICT
1941554 - CVE-2021-3449 openssl: NULL pointer dereference in signature_algorithms processing
1942040 - Rebase RHV-H 4.4.5 on RHEL-AV 8.3.1 Async
1942498 - Rebase RHV-H 4.4.5 on RHEL-8.3.1.3

6. Package List:

Red Hat Virtualization 4 Hypervisor for RHEL 8:

Source:
boost-1.66.0-10.el8.src.rpm
dyninst-10.1.0-4.el8.src.rpm
gcc-8.3.1-5.1.el8.src.rpm
isl-0.16.1-6.el8.src.rpm
libmpc-1.0.2-9.el8.src.rpm
libxcrypt-4.1.1-4.el8.src.rpm
make-4.2.1-10.el8.src.rpm
redhat-virtualization-host-4.4.5-20210330.0.el8_3.src.rpm
tbb-2018.2-9.el8.src.rpm
zip-3.0-23.el8.src.rpm

noarch:
redhat-virtualization-host-image-update-4.4.5-20210330.0.el8_3.noarch.rpm
vim-filesystem-8.0.1763-15.el8.noarch.rpm

x86_64:
boost-atomic-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-chrono-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-container-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-context-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-coroutine-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-date-time-1.66.0-10.el8.x86_64.rpm
boost-date-time-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-debugsource-1.66.0-10.el8.x86_64.rpm
boost-doctools-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-fiber-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-filesystem-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-graph-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-graph-mpich-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-graph-openmpi-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-iostreams-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-locale-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-log-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-math-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-mpich-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-mpich-python3-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-numpy3-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-openmpi-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-openmpi-python3-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-program-options-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-python3-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-random-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-regex-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-serialization-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-signals-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-stacktrace-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-system-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-test-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-thread-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-timer-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-type_erasure-debuginfo-1.66.0-10.el8.x86_64.rpm
boost-wave-debuginfo-1.66.0-10.el8.x86_64.rpm
bpftool-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm
compat-libmpc-debuginfo-1.0.2-9.el8.x86_64.rpm
cpp-8.3.1-5.1.el8.x86_64.rpm
cpp-debuginfo-8.3.1-5.1.el8.x86_64.rpm
dyninst-10.1.0-4.el8.x86_64.rpm
dyninst-debuginfo-10.1.0-4.el8.x86_64.rpm
dyninst-debugsource-10.1.0-4.el8.x86_64.rpm
dyninst-devel-debuginfo-10.1.0-4.el8.x86_64.rpm
dyninst-testsuite-debuginfo-10.1.0-4.el8.x86_64.rpm
gcc-8.3.1-5.1.el8.x86_64.rpm
gcc-c++-debuginfo-8.3.1-5.1.el8.x86_64.rpm
gcc-debuginfo-8.3.1-5.1.el8.x86_64.rpm
gcc-debugsource-8.3.1-5.1.el8.x86_64.rpm
gcc-gdb-plugin-debuginfo-8.3.1-5.1.el8.x86_64.rpm
gcc-gfortran-debuginfo-8.3.1-5.1.el8.x86_64.rpm
gcc-offload-nvptx-debuginfo-8.3.1-5.1.el8.x86_64.rpm
gcc-plugin-devel-debuginfo-8.3.1-5.1.el8.x86_64.rpm
glibc-debuginfo-2.28-127.el8_3.2.x86_64.rpm
glibc-debuginfo-common-2.28-127.el8_3.2.x86_64.rpm
glibc-devel-2.28-127.el8_3.2.x86_64.rpm
glibc-headers-2.28-127.el8_3.2.x86_64.rpm
isl-0.16.1-6.el8.x86_64.rpm
isl-debugsource-0.16.1-6.el8.x86_64.rpm
kernel-debug-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm
kernel-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm
kernel-debuginfo-common-x86_64-4.18.0-240.22.1.el8_3.x86_64.rpm
kernel-devel-4.18.0-240.22.1.el8_3.x86_64.rpm
kernel-headers-4.18.0-240.22.1.el8_3.x86_64.rpm
kernel-tools-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm
libasan-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libatomic-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libgcc-8.3.1-5.1.el8.x86_64.rpm
libgcc-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libgfortran-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libgomp-8.3.1-5.1.el8.x86_64.rpm
libgomp-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libgomp-offload-nvptx-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libitm-debuginfo-8.3.1-5.1.el8.x86_64.rpm
liblsan-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libmpc-1.0.2-9.el8.x86_64.rpm
libmpc-debuginfo-1.0.2-9.el8.x86_64.rpm
libmpc-debugsource-1.0.2-9.el8.x86_64.rpm
libquadmath-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libstdc++-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libtsan-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libubsan-debuginfo-8.3.1-5.1.el8.x86_64.rpm
libxcrypt-debugsource-4.1.1-4.el8.x86_64.rpm
libxcrypt-devel-4.1.1-4.el8.x86_64.rpm
make-4.2.1-10.el8.x86_64.rpm
make-debugsource-4.2.1-10.el8.x86_64.rpm
perf-4.18.0-240.22.1.el8_3.x86_64.rpm
perf-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm
python3-perf-debuginfo-4.18.0-240.22.1.el8_3.x86_64.rpm
tbb-2018.2-9.el8.x86_64.rpm
tbb-debugsource-2018.2-9.el8.x86_64.rpm
vim-X11-debuginfo-8.0.1763-15.el8.x86_64.rpm
vim-common-8.0.1763-15.el8.x86_64.rpm
vim-common-debuginfo-8.0.1763-15.el8.x86_64.rpm
vim-debuginfo-8.0.1763-15.el8.x86_64.rpm
vim-debugsource-8.0.1763-15.el8.x86_64.rpm
vim-enhanced-8.0.1763-15.el8.x86_64.rpm
vim-enhanced-debuginfo-8.0.1763-15.el8.x86_64.rpm
vim-minimal-debuginfo-8.0.1763-15.el8.x86_64.rpm
zip-3.0-23.el8.x86_64.rpm
zip-debugsource-3.0-23.el8.x86_64.rpm

RHEL 8-based RHEV-H for RHEV 4 (build requirements):

Source:
imgbased-1.2.18-0.1.el8ev.src.rpm
redhat-release-virtualization-host-4.4.5-4.el8ev.src.rpm
scap-security-guide-0.1.50-1.el8ev.src.rpm

noarch:
imgbased-1.2.18-0.1.el8ev.noarch.rpm
python3-imgbased-1.2.18-0.1.el8ev.noarch.rpm
redhat-virtualization-host-image-update-placeholder-4.4.5-4.el8ev.noarch.rpm
scap-security-guide-rhv-0.1.50-1.el8ev.noarch.rpm

x86_64:
redhat-release-virtualization-host-4.4.5-4.el8ev.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2021-3449
https://access.redhat.com/security/cve/CVE-2021-3450
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2021 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iQIVAwUBYHbW2dzjgjWX9erEAQhrvQ//VGyhTZ32NVUTnNMVVaHZyN5HL2Gt7CRG
sOA8Z7hKGGPq8nHZEeTtk2KBpxaLLzVHxKmILtnsRTlRqq2s4BSgd9j7YhNvTlZe
kK6Y3ovcWBKdqqui2ezZz9WFmKbQ5yjJImMo+TfyAS0D1RLwxNyKzDyYDCIZuO03
1AcV0ILWSVpaEKRrjOX6S0VnmMR0hqf4JmgLk8/ePv3wp+vd5voeIymWDPy6KrPW
0WS6NLHHNGucnzKXiRglwLeWKCYdQ+MCewkLKch/4eQPI28+N72dEgI9nhbZMind
khmKrnPDt5CIS9aWNmm+B/pWHZB1kEFt6hls/+xn2aXvrHxGgj6aTyl1peMhxYwA
bvlQx+p1jOOREgtvnQHwemAVEuZByW4QFWqdZn/BIqbImTjxlawqYRwHjWpOvMfo
Z6l7kiG86TsEWj/QJGAoRvwmqer7pWrttVeUivFBNmUhgZ8lEIMT3MkULY8VBJp+
PrwbQwfpMn38PZbnl/DT3A0aSgZ1Q1uQZooW8B6zBKYUdgwTU8impaBaKfyM9QRq
hCqHX42S4b/tNZhy64hlfkv24kei4RqgI4sGVeDfSA/tWzdgvBghQ1pOEhlPY4MH
jINgKocRD1f08X0meBmqk4IuoZdWkUrGgvprmT81At4ZF3omaQ1amKj1HhXpmJVa
da5fQnRzZzc=
=xbcY
-----END PGP SIGNATURE-----

--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://listman.redhat.com/mailman/listinfo/rhsa-announce