Bug 2046038

Summary: CVE-2021-4034 polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector [ovirt-4.4]
Product: [oVirt] ovirt-node Reporter: Sandro Bonazzola <sbonazzo>
Component: Included packagesAssignee: Sandro Bonazzola <sbonazzo>
Status: CLOSED CURRENTRELEASE QA Contact: cshao <cshao>
Severity: high Docs Contact:
Priority: unspecified    
Version: 4.4.10CC: arachman, bugs, cshao, lsvaty, lveyde, mavital, peyu, sanja, sbonazzo, weiwang, yaniwang
Target Milestone: ovirt-4.4.10-1Keywords: Rebase, Security, SecurityTracking, ZStream
Target Release: 4.4.10Flags: sbonazzo: ovirt-4.4+
cshao: testing_ack+
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: ovirt-node-ng-installer-4.4.10-2022020214.el8.iso Doc Type: No Doc Update
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2022-02-02 16:14:01 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: Node RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2025975    
Bug Blocks: 2025869    
Deadline: 2022-03-03   

Description Sandro Bonazzola 2022-01-26 08:47:27 UTC 
This bug was created to ensure that one or more security vulnerabilities are fixed in affected versions of oVirt.

For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
Comment 1 Sandro Bonazzola 2022-01-28 16:01:18 UTC 
polkit-0.115-13.el8_5.1.x86_64.rpm landed on http://mirror.centos.org/centos/8-stream/BaseOS/x86_64/os/
pending oVirt Node rebuild.
Comment 2 Sandro Bonazzola 2022-02-02 16:14:01 UTC 
ISO: https://resources.ovirt.org/pub/ovirt-4.4/iso/ovirt-node-ng-installer/4.4.10-2022020214/el8/ovirt-node-ng-installer-4.4.10-2022020214.el8.iso