| Description: | Summary:
The remote host is missing an update for the Huawei EulerOS 'libvirt' package(s) announced via the EulerOS-SA-2019-1456 advisory.
Vulnerability Insight:
util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.(CVE-2018-6764)
qemu/qemu_monitor.c in libvirt allows attackers to cause a denial of service (memory consumption) via a large QEMU reply.(CVE-2018-5748)
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of 'verify-peer=no' passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default. (CVE-2019-3840)
libvirt version 2.3.0 and later is vulnerable to a bad default configuration of 'verify-peer=no' passed to QEMU by libvirt resulting in a failure to validate SSL/TLS certificates by default.(CVE-2017-1000256)
An incomplete fix for CVE-2018-5748 that affects QEMU monitor leading to a resource exhaustion but now also triggered via QEMU guest agent.(CVE-2018-1064)
Affected Software/OS:
'libvirt' package(s) on Huawei EulerOS Virtualization 3.0.1.0.
Solution:
Please install the updated package(s).
CVSS Score:
6.8
CVSS Vector:
AV:N/AC:M/Au:N/C:P/I:P/A:P
|
