RHSA-2014:0038: Red Hat RHEV 3.3 CVE-2013-6434 SPICE TLS Stripping Vulnerability Fix

Key Information Advisory ID: RHSA-2014:0038 Affected Software: Red Hat Enterprise Virtualization Manager 3.3.0 Security Level: Important (Security Advisory: Important) Release Date: 2014-01-21 Update Date: 2014-01-21 Summary: Updated Red Hat Enterprise Virtualization Manager 3.3 Vulnerability Details This advisory describes a critical vulnerability: when using the native SPICE client, Red Hat Enterprise Virtualization Manager fails to properly pass remote SPICE connection information to the remote viewer, allowing attackers to perform a man-in-the-middle attack (CVE-2013-6434). Solution and Affected Products Solution: Users of Red Hat Enterprise Virtualization Manager are advised to upgrade to these updated packages. Affected Products: Red Hat Virtualization 3.3 x86_64 Fixes Included Includes multiple fixes categorized under PRD33, RFE, etc., addressing various bugs and adding enhancements. Examples include: support for multiple displays, improved binding logic, performance improvements, etc. CVE References CVE-2013-6434: RHEV Remote Viewer SPICE TLS Stripping Issue References Security Classification: https://access.redhat.com/security/updates/classification/#important Technical Documentation: https://access.redhat.com/site/documentation/en-US/Red_Hat_Enterprise_Virtualization/3.3/html/Technical_Notes/chap-RHSA-20140038-_rhevm.html

Goal Reached Thanks to every supporter — we hit 100%!

RHSA-2014:0038: Red Hat RHEV 3.3 CVE-2013-6434 SPICE TLS Stripping Vulnerability Fix