CVE-2013-4236
Fixed in a distro release EPSS <1%
VDSM in Red Hat Enterprise Virtualization 3 and 3.2 allows privileged guest users to cause the host to become "unavailable to the managment server" via invalid XML characters in a guest agent response. NOTE: this issue is due to an incomplete fix for CVE-2013-0167.
Products: redhat enterprise_virtualization
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat Enterprise Linux 6 | rhev-hypervisor6 | 0:6.4-20130815.0.el6_4 |
| Red Hat Enterprise Linux 6 | vdsm | 0:4.10.2-24.0.el6ev |
| Red Hat Enterprise Linux 6 | vdsm-cli | 0:4.10.2-24.0.el6ev |
| Red Hat Enterprise Linux 6 | vdsm-debuginfo | 0:4.10.2-24.0.el6ev |
| Red Hat Enterprise Linux 6 | vdsm-hook-vhostmd | 0:4.10.2-24.0.el6ev |
| Red Hat Enterprise Linux 6 | vdsm-python | 0:4.10.2-24.0.el6ev |
| Red Hat Enterprise Linux 6 | vdsm-reg | 0:4.10.2-24.0.el6ev |
| Red Hat Enterprise Linux 6 | vdsm-xmlrpc | 0:4.10.2-24.0.el6ev |
| Red Hat rhev manager 3 | vdsm | 0:4.10.2-24.0.el6ev |
| Red Hat rhev manager 3 | vdsm-bootstrap | 0:4.10.2-24.0.el6ev |
| Red Hat rhev manager 3 | vdsm-debuginfo | 0:4.10.2-24.0.el6ev |