LoginSign Up
← Back to all sparks
O

oVirt

INFRA · APIS
Velocity0.0

Open source virtualization management platform for KVM infrastructure

ovirt.org ↗

A virtualization manager coasting on backports, with releases years apart

virtualizationmaintenance-modebackportsovf-importkeycloak
◆Current state
oVirt Engine's release feed is sparse and slowing: 4.5.5 in late 2023, 4.5.6 and a pair of 4.5.3.x backports in early 2024, then nothing until 4.5.7 in December 2025. Almost every entry is a list of targeted fixes and backports rather than features — OVF import edge cases, template handling, NVRAM save/restore logic, CA generation as a non-root user, Keycloak group handling. One CVE, CVE-2024-0822, appears in 4.5.6 and its 4.5.3 backport.
◆Where it's heading
This reads as a mature platform in maintenance rather than one being developed. The parallel 4.5.3.x stream exists purely to carry fixes back to deployments that cannot move, and the two-year gap between 4.5.6 and 4.5.7 says more about the project's momentum than any individual change does. Nothing in these entries points toward new capability.
◆Prediction
The entries do not support a confident call on where this goes next; the only observable pattern is long gaps punctuated by accumulated fix rollups, so another such rollup is the most that can be inferred.

◆Recent moves

  1. 10mo ago

    4.5.7 lands after a two-year gap with accumulated fixes

    The first release in roughly two years, bundling NVRAM save/restore logic changes, CA generation as a non-root user, Keycloak empty-group handling, and database cleanup after materialized view removal. Its content is unremarkable; its timing is the signal.

    View source ↗
  2. 2y ago

    oVirt Engine 4.5.3.11

    A single backport excluding shared disks when iterating during VM import from a storage domain. One fix, nothing else.

    View source ↗
  3. 2y ago

    4.5.6 fixes CVE-2024-0822 in GWT session creation

    Disables execution of CreateUserSession from GWT code to close CVE-2024-0822, alongside a kernel cmdline quoting fix and restoration of the grafana.db SELinux context after engine-restore. The security fix is the reason to take this release.

    View source ↗
  4. 2y ago

    4.5.3.10 backports the GWT session security fix

    Carries the CreateUserSession fix back to the 4.5.3 stream along with a fix to fail properly when getVolumeInfo fails during OVF read. Exists so deployments pinned to 4.5.3 are not left exposed.

    View source ↗
  5. 2y ago

    4.5.5 clears OVF import, template and image removal bugs

    The broadest fix release in the window: internal OVF reading now also looks for InstanceID, NPEs during OVA import are fixed, RemoveImage execution is corrected, template name length checks fixed, and user-role entity search repaired. Import and template handling dominate, which is where this engine's bugs cluster.

    View source ↗
  6. 3y ago

    build: ovirt-engine-4.5.3.9

    A build tag whose entire body is a sign-off line. No described change.

    View source ↗