libvirt-0.10.2-64.2.0.1.AXS4

エラータID: AXSA:2019-3920:02

Release date: 
Tuesday, July 2, 2019 - 09:37
Subject: 
libvirt-0.10.2-64.2.0.1.AXS4
Affected Channels: 
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity: 
Moderate
Description: 

The libvirt library contains a C API for managing and interacting with the virtualization capabilities of Linux and other operating systems. In addition, libvirt provides tools for remote management of virtualized systems.

Security Fix(es):

* libvirt: arbitrary file read/exec via virDomainSaveImageGetXMLDesc API (CVE-2019-10161)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

CVE-2019-10161
** RESERVED ** This candidate has been reserved by an organization or individual that will use it when announcing a new security problem. When the candidate has been publicized, the details for this candidate will be provided.

Solution: 

Update packages.

CVEs: 
CVE-2019-10161
It was discovered that libvirtd before versions 4.10.1 and 5.4.1 would permit read-only clients to use the virDomainSaveImageGetXMLDesc() API, specifying an arbitrary path which would be accessed with the permissions of the libvirtd process. An attacker with access to the libvirtd socket could use this to probe the existence of arbitrary files, cause denial of service or cause libvirtd to execute arbitrary programs.
Additional Info: 

N/A

Download: 

SRPMS
  1. libvirt-0.10.2-64.2.0.1.AXS4.src.rpm
    MD5: 162b490100bdb2ab4df4449a0de659a7
    SHA-256: 9ca35e4c30c5d256598fa0e1a36bb1ef3125d4c9e776d79e56dcbe815f41a2ac
    Size: 22.43 MB

Asianux Server 4 for x86
  1. libvirt-0.10.2-64.2.0.1.AXS4.i686.rpm
    MD5: ebe5ab3687518ee0145b5972592bd1c3
    SHA-256: 864ff41f51df8ba3176f680f18f7887c2a209caa2e0cb74742e5ab842f60ab64
    Size: 2.15 MB
  2. libvirt-client-0.10.2-64.2.0.1.AXS4.i686.rpm
    MD5: 5fa61fe994c09624aaea2479f0f29f70
    SHA-256: 6b0cccfae7007769367627b39b3427fd4db22e3d109a666c855c507416c577a0
    Size: 4.06 MB
  3. libvirt-devel-0.10.2-64.2.0.1.AXS4.i686.rpm
    MD5: 7bac4abe6f194b682c77e0be6bfaac97
    SHA-256: 0f56ace933ef067acc643d10ae909336c769fae68d9f3450cb6d4325517741f5
    Size: 441.07 kB
  4. libvirt-python-0.10.2-64.2.0.1.AXS4.i686.rpm
    MD5: eaa06b79edaa4664ae7f75dc82809933
    SHA-256: 441951dd6245a698704a19debcb27e3b3ac07851c8bfd3dff98a61b57b69669e
    Size: 505.64 kB

Asianux Server 4 for x86_64
  1. libvirt-0.10.2-64.2.0.1.AXS4.x86_64.rpm
    MD5: 19732843230208e57494df109c1b3d61
    SHA-256: 9e2457099163b54bc730ee7e3314dfc48626667b8a1ccea183082e81f1ebf32a
    Size: 2.43 MB
  2. libvirt-client-0.10.2-64.2.0.1.AXS4.x86_64.rpm
    MD5: f8d260c6e2b5f69930c8e785932b6e76
    SHA-256: 72ef3538551173e8a9037339d0657350741356d713ccc2c7ef16233866c62cad
    Size: 4.08 MB
  3. libvirt-devel-0.10.2-64.2.0.1.AXS4.x86_64.rpm
    MD5: c98af3c98ab113754ca9b5d80bf385b2
    SHA-256: ad7b5163b051fddb94225a763087ca5c51df3e71a8966944ac5c02491070b4b3
    Size: 440.64 kB
  4. libvirt-python-0.10.2-64.2.0.1.AXS4.x86_64.rpm
    MD5: 3c6c88816c02948a69ae62af7f8f7cd2
    SHA-256: a83916773b399aeb1cfec1444954b7e3395e7037b7253fc8fc6fe00d8e660eda
    Size: 505.23 kB
  5. libvirt-client-0.10.2-64.2.0.1.AXS4.i686.rpm
    MD5: 5fa61fe994c09624aaea2479f0f29f70
    SHA-256: 6b0cccfae7007769367627b39b3427fd4db22e3d109a666c855c507416c577a0
    Size: 4.06 MB
  6. libvirt-devel-0.10.2-64.2.0.1.AXS4.i686.rpm
    MD5: 7bac4abe6f194b682c77e0be6bfaac97
    SHA-256: 0f56ace933ef067acc643d10ae909336c769fae68d9f3450cb6d4325517741f5
    Size: 441.07 kB