{
  "threat_severity" : "Moderate",
  "public_date" : "2019-12-05T00:00:00Z",
  "bugzilla" : {
    "description" : "libvirt: Potential DoS by holding a monitor job while querying QEMU guest-agent",
    "id" : "1809740",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1809740"
  },
  "cvss3" : {
    "cvss3_base_score" : "5.8",
    "cvss3_scoring_vector" : "CVSS:3.1/AV:A/AC:H/PR:L/UI:N/S:C/C:N/I:N/A:H",
    "status" : "verified"
  },
  "cwe" : "CWE-400",
  "details" : [ "qemu/qemu_driver.c in libvirt before 6.0.0 mishandles the holding of a monitor job during a query to a guest agent, which allows attackers to cause a denial of service (API blockage).", "A flaw was found in the way the libvirtd daemon issued the 'suspend' command to a QEMU guest-agent running inside a guest, where it holds a monitor job while issuing the 'suspend' command to a guest-agent. A malicious guest-agent may use this flaw to block the libvirt daemon indefinitely, resulting in a denial of service." ],
  "statement" : "This issue affects the version of the libvirt package as shipped with Red Hat Enterprise Linux 7, 8 and Red Hat Enterprise Linux Advanced Virtualization 8. Future libvirt updates for Red Hat Enterprise Linux 7, 8 and Red Hat Enterprise Linux Advanced Virtualization 8 may address this issue.\nRed Hat Enterprise Linux version 5 and 6 are in Maintenance Support 2 Phase of the life cycle. This issue has been rated as having Moderate security impact and is not currently planned to be addressed in future updates of the Red Hat Enterprise Linux version 5 and 6. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.",
  "acknowledgement" : "This issue was discovered by Eric Blake (Red Hat Inc.).",
  "affected_release" : [ {
    "product_name" : "Advanced Virtualization for RHEL 8.2.0",
    "release_date" : "2020-05-05T00:00:00Z",
    "advisory" : "RHBA-2020:2017",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.2::el8",
    "package" : "virt:8.2-8020020200414225921.6a468ee4"
  }, {
    "product_name" : "Advanced Virtualization for RHEL 8.2.0",
    "release_date" : "2020-05-05T00:00:00Z",
    "advisory" : "RHBA-2020:2017",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8.2::el8",
    "package" : "virt-devel:8.2-8020020200414225921.6a468ee4"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "release_date" : "2020-09-29T00:00:00Z",
    "advisory" : "RHSA-2020:4000",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7",
    "package" : "libvirt-0:4.5.0-36.el7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2020-11-04T00:00:00Z",
    "advisory" : "RHSA-2020:4676",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "virt-devel:rhel-8030020200909014558.30b713e6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8",
    "release_date" : "2020-11-04T00:00:00Z",
    "advisory" : "RHSA-2020:4676",
    "cpe" : "cpe:/a:redhat:enterprise_linux:8",
    "package" : "virt:rhel-8030020200909014558.30b713e6"
  } ],
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Out of support scope",
    "package_name" : "libvirt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Out of support scope",
    "package_name" : "libvirt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 8 Advanced Virtualization",
    "fix_state" : "Affected",
    "package_name" : "virt:8.1/libvirt",
    "cpe" : "cpe:/a:redhat:advanced_virtualization:8::el8"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2019-20485\nhttps://nvd.nist.gov/vuln/detail/CVE-2019-20485" ],
  "name" : "CVE-2019-20485",
  "csaw" : false
}