RHSA-2018:1676: Important: org.ovirt.engine-root security update

Published May 21, 2018
·
Updated

The org.ovirt.engine-root is a core component of oVirt.Security Fix(es): An industry-wide issue was found in the way many modern microprocessor designs have implemented speculative execution of Load & Store instructions (a commonly used performance optimization). It relies on the presence of a precisely-defined instruction sequence in the privileged code as well as the fact that memory read from address to which a recent memory write has occurred may see an older value and subsequently cause an update into the microprocessor's data cache even for speculatively executed instructions that never actually commit (retire). As a result, an unprivileged attacker could use this flaw to read privileged memory by conducting targeted cache side-channel attacks. (CVE-2018-3639) Note: This is the org.ovirt.engine-root side of the CVE-2018-3639 mitigation.Red Hat would like to thank Ken Johnson (Microsoft Security Response Center) and Jann Horn (Google Project Zero) for reporting this issue.

Affected Software

21 affected componentsFixes available
redhat/ovirt-engine<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-backend<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-dbscripts<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-extensions-api-impl<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-extensions-api-impl-javadoc<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-health-check-bundler<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-lib<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-restapi<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-setup<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-setup-base<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-setup-plugin-ovirt-engine<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-setup-plugin-ovirt-engine-common<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-setup-plugin-vmconsole-proxy-helper<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-setup-plugin-websocket-proxy<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-tools<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-tools-backup<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-vmconsole-proxy-helper<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-webadmin-portal<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/ovirt-engine-websocket-proxy<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7
redhat/rhvm<4.2.3.6-0.1.el7
4.2.3.6-0.1.el7

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade redhat/ovirt-engine to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  2. Upgrade

    Upgrade redhat/ovirt-engine-backend to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  3. Upgrade

    Upgrade redhat/ovirt-engine-dbscripts to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  4. Upgrade

    Upgrade redhat/ovirt-engine-extensions-api-impl to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  5. Upgrade

    Upgrade redhat/ovirt-engine-extensions-api-impl-javadoc to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  6. Upgrade

    Upgrade redhat/ovirt-engine-health-check-bundler to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  7. Upgrade

    Upgrade redhat/ovirt-engine-lib to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  8. Upgrade

    Upgrade redhat/ovirt-engine-restapi to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  9. Upgrade

    Upgrade redhat/ovirt-engine-setup to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  10. Upgrade

    Upgrade redhat/ovirt-engine-setup-base to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  11. Upgrade

    Upgrade redhat/ovirt-engine-setup-plugin-ovirt-engine to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  12. Upgrade

    Upgrade redhat/ovirt-engine-setup-plugin-ovirt-engine-common to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  13. Upgrade

    Upgrade redhat/ovirt-engine-setup-plugin-vmconsole-proxy-helper to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  14. Upgrade

    Upgrade redhat/ovirt-engine-setup-plugin-websocket-proxy to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  15. Upgrade

    Upgrade redhat/ovirt-engine-tools to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  16. Upgrade

    Upgrade redhat/ovirt-engine-tools-backup to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  17. Upgrade

    Upgrade redhat/ovirt-engine-vmconsole-proxy-helper to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  18. Upgrade

    Upgrade redhat/ovirt-engine-webadmin-portal to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  19. Upgrade

    Upgrade redhat/ovirt-engine-websocket-proxy to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7
  20. Upgrade

    Upgrade redhat/rhvm to a version that resolves this vulnerability.

    Fixed in 4.2.3.6-0.1.el7

Event History

Jul 26, 2026
Advisory Published
via Red Hat·11:43 AM
Data Sourced
via Red Hat·11:43 AM
RemedyDescriptionAffected Software
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of RHSA-2018:1676?

The severity of RHSA-2018:1676 is classified as important.

2

How do I fix RHSA-2018:1676?

To fix RHSA-2018:1676, update the affected ovirt-engine packages to version 4.2.3.6-0.1.el7.

3

Which packages are affected by RHSA-2018:1676?

The affected packages include ovirt-engine, ovirt-engine-backend, ovirt-engine-dbscripts, and several others.

4

What is the nature of the vulnerability in RHSA-2018:1676?

The vulnerability in RHSA-2018:1676 is related to speculative execution issues affecting modern microprocesses.

5

Is RHSA-2018:1676 related to any recent security trends?

Yes, RHSA-2018:1676 is part of an industry-wide recognition of vulnerabilities associated with speculative execution in processors.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203