Information disclosure in libvirt - CVE-2020-14301

Vulnerability identifier: #VU31937

CSH Severity: Low

CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2020-14301

CWE-ID: CWE-200

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due implementation of cookies for HTTP-based disks formatted them in the XML even if the VIR_DOMAIN_XML_SECURE was not present. A remote attacker can gain unauthorized access to sensitive information.

libvirt
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for ARM 64
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Anolis OS
netcf
netcf-devel
netcf-libs
swtpm-tools-pkcs11
swtpm-tools
swtpm-libs
swtpm-devel
swtpm
libtpms-devel
libtpms
sgabios-bin
sgabios
libvirt-dbus
ruby-hivex
python3-hivex
perl-hivex
ocaml-hivex-devel
ocaml-hivex
hivex
hivex-devel
ocaml-libnbd
ocaml-libnbd-devel
nbdfuse
libnbd-devel
libnbd
python3-libnbd
libnbd-bash-completion
seabios-bin
seavgabios-bin
seabios
libiscsi
libiscsi-devel
libiscsi-utils
nbdkit-ssh-plugin
nbdkit-vddk-plugin
nbdkit
nbdkit-basic-filters
nbdkit-basic-plugins
nbdkit-curl-plugin
nbdkit-devel
nbdkit-example-plugins
nbdkit-gzip-filter
nbdkit-gzip-plugin
nbdkit-linuxdisk-plugin
nbdkit-nbd-plugin
nbdkit-python-plugin
nbdkit-server
nbdkit-tar-filter
nbdkit-tar-plugin
nbdkit-tmpdisk-plugin
nbdkit-xz-filter
nbdkit-bash-completion
virt-v2v-man-pages-uk
virt-v2v-man-pages-ja
virt-v2v-bash-completion
virt-v2v
libguestfs-java
ruby-libguestfs
lua-guestfs
ocaml-libguestfs
ocaml-libguestfs-devel
libguestfs-java-devel
virt-dib
perl-Sys-Guestfs
libguestfs-rescue
libguestfs-rsync
libguestfs-tools-c
python3-libguestfs
libguestfs-xfs
libguestfs-gobject-devel
libguestfs-bash-completion
libguestfs
libguestfs-inspect-icons
libguestfs-javadoc
libguestfs-man-pages-ja
libguestfs-man-pages-uk
libguestfs-tools
libguestfs-gobject
libguestfs-gfs2
libguestfs-devel
libguestfs-appliance
supermin
supermin-devel
qemu-kvm-common
qemu-kvm-tests
qemu-kvm-docs
qemu-kvm-core
qemu-kvm-block-rbd
qemu-kvm-block-gluster
qemu-kvm-hw-usbredir
qemu-kvm-ui-opengl
qemu-kvm-ui-spice
qemu-user-static
qemu-kvm-block-iscsi
qemu-kvm-block-curl
qemu-kvm
qemu-kvm-block-ssh
qemu-img
qemu-guest-agent
perl-Sys-Virt
python3-libvirt
libvirt-daemon-driver-storage-gluster
libvirt-wireshark
libvirt-daemon-driver-storage-iscsi
libvirt-daemon-driver-storage-iscsi-direct
libvirt-daemon-driver-storage-logical
libvirt-daemon-driver-storage-mpath
libvirt-daemon-driver-storage-rbd
libvirt-daemon-driver-storage-scsi
libvirt-daemon-kvm
libvirt-devel
libvirt-docs
libvirt-libs
libvirt-lock-sanlock
libvirt-nss
libvirt-daemon-driver-storage-disk
libvirt-daemon-driver-storage-core
libvirt-daemon-driver-storage
libvirt-daemon-driver-secret
libvirt-daemon-driver-qemu
libvirt-daemon-driver-nwfilter
libvirt-daemon-driver-nodedev
libvirt-daemon-driver-network
libvirt-daemon-driver-interface
libvirt-daemon-config-nwfilter
libvirt-daemon-config-network
libvirt-daemon
libvirt-client
libvirt
libguestfs-winsupport

Install updates from vendor's website.

libvirt - update to 6.3.0
netcf - update to 0.2.8-12.0.1
netcf-devel - update to 0.2.8-12.0.1
netcf-libs - update to 0.2.8-12.0.1
swtpm-tools-pkcs11 - update to 0.7.0-4.20211109gitb79fd91
swtpm-tools - update to 0.7.0-4.20211109gitb79fd91
swtpm-libs - update to 0.7.0-4.20211109gitb79fd91
swtpm-devel - update to 0.7.0-4.20211109gitb79fd91
swtpm - update to 0.7.0-4.20211109gitb79fd91
libtpms-devel - update to 0.9.1-2.20211126git1ff6fe1f43
libtpms - update to 0.9.1-2.20211126git1ff6fe1f43
sgabios-bin - update to 0.20170427git-3
sgabios - update to 0.20170427git-3
libvirt-dbus - update to 1.3.0-2
ruby-hivex - update to 1.3.18-23
python3-hivex - update to 1.3.18-23
perl-hivex - update to 1.3.18-23
ocaml-hivex-devel - update to 1.3.18-23
ocaml-hivex - update to 1.3.18-23
hivex - update to 1.3.18-23
hivex-devel - update to 1.3.18-23
ocaml-libnbd - update to 1.6.0-5.0.2
ocaml-libnbd-devel - update to 1.6.0-5.0.2
nbdfuse - update to 1.6.0-5.0.2
libnbd-devel - update to 1.6.0-5.0.2
libnbd - update to 1.6.0-5.0.2
python3-libnbd - update to 1.6.0-5.0.2
libnbd-bash-completion - update to 1.6.0-5.0.2
seabios-bin - update to 1.16.0-4
seavgabios-bin - update to 1.16.0-4
seabios - update to 1.16.0-4
libiscsi - update to 1.18.0-8.0.1
libiscsi-devel - update to 1.18.0-8.0.1
libiscsi-utils - update to 1.18.0-8.0.1
nbdkit-ssh-plugin - update to 1.24.0-5
nbdkit-vddk-plugin - update to 1.24.0-5
nbdkit - update to 1.24.0-5
nbdkit-basic-filters - update to 1.24.0-5
nbdkit-basic-plugins - update to 1.24.0-5
nbdkit-curl-plugin - update to 1.24.0-5
nbdkit-devel - update to 1.24.0-5
nbdkit-example-plugins - update to 1.24.0-5
nbdkit-gzip-filter - update to 1.24.0-5
nbdkit-gzip-plugin - update to 1.24.0-5
nbdkit-linuxdisk-plugin - update to 1.24.0-5
nbdkit-nbd-plugin - update to 1.24.0-5
nbdkit-python-plugin - update to 1.24.0-5
nbdkit-server - update to 1.24.0-5
nbdkit-tar-filter - update to 1.24.0-5
nbdkit-tar-plugin - update to 1.24.0-5
nbdkit-tmpdisk-plugin - update to 1.24.0-5
nbdkit-xz-filter - update to 1.24.0-5
nbdkit-bash-completion - update to 1.24.0-5
virt-v2v-man-pages-uk - update to 1.42.0-22
virt-v2v-man-pages-ja - update to 1.42.0-22
virt-v2v-bash-completion - update to 1.42.0-22
virt-v2v - update to 1.42.0-22
libguestfs-java - update to 1.44.0-9.0.1
ruby-libguestfs - update to 1.44.0-9.0.1
lua-guestfs - update to 1.44.0-9.0.1
ocaml-libguestfs - update to 1.44.0-9.0.1
ocaml-libguestfs-devel - update to 1.44.0-9.0.1
libguestfs-java-devel - update to 1.44.0-9.0.1
virt-dib - update to 1.44.0-9.0.1
perl-Sys-Guestfs - update to 1.44.0-9.0.1
libguestfs-rescue - update to 1.44.0-9.0.1
libguestfs-rsync - update to 1.44.0-9.0.1
libguestfs-tools-c - update to 1.44.0-9.0.1
python3-libguestfs - update to 1.44.0-9.0.1
libguestfs-xfs - update to 1.44.0-9.0.1
libguestfs-gobject-devel - update to 1.44.0-9.0.1
libguestfs-bash-completion - update to 1.44.0-9.0.1
libguestfs - update to 1.44.0-9.0.1
libguestfs-inspect-icons - update to 1.44.0-9.0.1
libguestfs-javadoc - update to 1.44.0-9.0.1
libguestfs-man-pages-ja - update to 1.44.0-9.0.1
libguestfs-man-pages-uk - update to 1.44.0-9.0.1
libguestfs-tools - update to 1.44.0-9.0.1
libguestfs-gobject - update to 1.44.0-9.0.1
libguestfs-gfs2 - update to 1.44.0-9.0.1
libguestfs-devel - update to 1.44.0-9.0.1
libguestfs-appliance - update to 1.44.0-9.0.1
supermin - update to 5.2.1-2.0.2
supermin-devel - update to 5.2.1-2.0.2
qemu-kvm-common - update to 6.2.0-50.0.1
qemu-kvm-tests - update to 6.2.0-50.0.1
qemu-kvm-docs - update to 6.2.0-50.0.1
qemu-kvm-core - update to 6.2.0-50.0.1
qemu-kvm-block-rbd - update to 6.2.0-50.0.1
qemu-kvm-block-gluster - update to 6.2.0-50.0.1
qemu-kvm-hw-usbredir - update to 6.2.0-50.0.1
qemu-kvm-ui-opengl - update to 6.2.0-50.0.1
qemu-kvm-ui-spice - update to 6.2.0-50.0.1
qemu-user-static - update to 6.2.0-50.0.1
qemu-kvm-block-iscsi - update to 6.2.0-50.0.1
qemu-kvm-block-curl - update to 6.2.0-50.0.1
qemu-kvm - update to 6.2.0-50.0.1
qemu-kvm-block-ssh - update to 6.2.0-50.0.1
qemu-img - update to 6.2.0-50.0.1
qemu-guest-agent - update to 6.2.0-50.0.1
perl-Sys-Virt - update to 8.0.0-1
python3-libvirt - update to 8.0.0-2
libvirt-daemon-driver-storage-gluster - update to 8.0.0-23.2.0.1
libvirt-wireshark - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-storage-iscsi - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-storage-iscsi-direct - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-storage-logical - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-storage-mpath - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-storage-rbd - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-storage-scsi - update to 8.0.0-23.2.0.1
libvirt-daemon-kvm - update to 8.0.0-23.2.0.1
libvirt-devel - update to 8.0.0-23.2.0.1
libvirt-docs - update to 8.0.0-23.2.0.1
libvirt-libs - update to 8.0.0-23.2.0.1
libvirt-lock-sanlock - update to 8.0.0-23.2.0.1
libvirt-nss - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-storage-disk - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-storage-core - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-storage - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-secret - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-qemu - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-nwfilter - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-nodedev - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-network - update to 8.0.0-23.2.0.1
libvirt-daemon-driver-interface - update to 8.0.0-23.2.0.1
libvirt-daemon-config-nwfilter - update to 8.0.0-23.2.0.1
libvirt-daemon-config-network - update to 8.0.0-23.2.0.1
libvirt-daemon - update to 8.0.0-23.2.0.1
libvirt-client - update to 8.0.0-23.2.0.1
libvirt - update to 8.0.0-23.2.0.1
libguestfs-winsupport - update to 8.10-1

• https://security.libvirt.org/2020/0002.html

• Information disclosure in Libvirt
• Red Hat Enterprise Linux 8 update for the virt:rhel and virt-devel:rhel modules
• Anolis OS update for virt:an module