CVE-2016-6338
Fixed in a distro release EPSS <1%
ovirt-engine-webadmin, as used in Red Hat Enterprise Virtualization Manager (aka RHEV-M) for Servers and RHEV-M 4.0, allows physically proximate attackers to bypass a webadmin session timeout restriction via vectors related to UI selections, which trigger repeating queries.
Products: redhat enterprise_virtualization
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Red Hat rhev manager 4 | ovirt-engine | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-backend | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-dbscripts | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-extensions-api-impl | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-extensions-api-impl-javadoc | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-lib | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-restapi | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-setup | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-setup-base | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-setup-plugin-ovirt-engine | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-setup-plugin-ovirt-engine-common | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-setup-plugin-vmconsole-proxy-helper | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-setup-plugin-websocket-proxy | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-tools | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-tools-backup | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-userportal | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-vmconsole-proxy-helper | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-webadmin-portal | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | ovirt-engine-websocket-proxy | 0:4.1.8.2-0.1.el7 |
| Red Hat rhev manager 4 | rhevm | 0:4.1.8.2-0.1.el7 |