RHSA-2021:0381LowCVSS 7.5

Red Hat Security Advisory: RHV-M(ovirt-engine) 4.4.z security, bug fix, enhancement update [ovirt-4.4.4]

Published
February 2, 2021
Last Modified
August 4, 2026

🔗 CVE IDs covered (1)

CVE-2020-25649 →

📋 Description

CVE-2020-25649 — jackson-databind: FasterXML DOMDeserializer insecure entity expansion is vulnerable to XML external entity (XXE)

🎯 Affected products34

  • RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-0:4.4.4.5-0.10.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-backend-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-dbscripts-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-dwh-0:4.4.4.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-dwh-0:4.4.4.2-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-dwh-grafana-integration-setup-0:4.4.4.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-dwh-setup-0:4.4.4.2-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-health-check-bundler-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-restapi-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-setup-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-setup-base-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-setup-plugin-cinderlib-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-setup-plugin-imageio-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-setup-plugin-ovirt-engine-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-setup-plugin-ovirt-engine-common-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-setup-plugin-vmconsole-proxy-helper-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-setup-plugin-websocket-proxy-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-tools-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-tools-backup-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-vmconsole-proxy-helper-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-webadmin-portal-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-engine-websocket-proxy-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-web-ui-0:1.6.6-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • ovirt-web-ui-0:1.6.6-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • python3-ovirt-engine-lib-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • rhv-log-collector-analyzer-0:1.0.6-1.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • rhv-log-collector-analyzer-0:1.0.6-1.el8ev.src as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • rhvm-0:4.4.4.5-0.10.el8ev.noarch as a component of RHEL-8-RHEV-S-4.4 - Red Hat Virtualization Engine 4.4
  • +4 more not shown

✅ Remediation

For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/2974891 Workaround: There is currently no known mitigation for this flaw.

🔗 References (18)