-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ===================================================================== Red Hat Security Advisory Synopsis: Important: CFME 5.7.3 security, bug fix and enhancement update Advisory ID: RHSA-2017:1601-01 Product: Red Hat CloudForms Advisory URL: https://access.redhat.com/errata/RHSA-2017:1601 Issue date: 2017-06-28 Cross references: RHSA-2017:0898 CVE Names: CVE-2016-4457 CVE-2016-7047 CVE-2017-7497 ===================================================================== 1. Summary: Updates for cfme, cfme-appliance, cfme-gemset, rh-ruby23-rubygem-nokogiri, and rh-ruby23-rubygem-ovirt-engine-sdk4 are now available for CloudForms Management Engine 5.7. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: CloudForms Management Engine 5.7 - noarch, x86_64 3. Description: Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components. rh-ruby23-rubygem-nokogiri provides Nokogiri, which is an HTML, XML, SAX, and Reader parser. Among Nokogiri's many features is the ability to search documents using XPath or CSS3 selectors. rh-ruby23-rubygem-ovirt-engine-sdk4 provides the ruby SDK for the oVirt Engine API. The following packages have been upgraded to a later upstream version: cfme (5.7.3.2), cfme-gemset (5.7.3.2), rh-ruby23-rubygem-nokogiri (1.7.2), cfme-appliance (5.7.3.2), rh-ruby23-rubygem-ovirt-engine-sdk4 (4.1.5). (BZ#1442774, BZ#1459319) This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Technical Notes document linked to in the References section. Security Fix(es): * CloudForms includes a default SSL/TLS certificate for the web server. This certificate is replaced at install time. However if an attacker were able to man-in-the-middle an administrator while installing the new certificate, the attacker could get a copy of the uploaded private key allowing for future attacks. (CVE-2016-4457) * The dialog for creating cloud volumes (cinder provider) in CloudForms does not filter cloud tenants by user. An attacker with the ability to create storage volumes could use this to create storage volumes for any other tenant. (CVE-2017-7497) * A flaw was found in the CloudForms API. A user with permissions to use the MiqReportResults capability within the API could potentially view data from other tenants or groups to which they should not have access. (CVE-2016-7047) The CVE-2016-4457 and CVE-2016-7047 issues were discovered by Simon Lukasik (Red Hat) and the CVE-2017-7497 issue was discovered by Gellert Kis (Red Hat). 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1322396 - [RFE] Allow for deletion of group when users belong to another group 1341308 - CVE-2016-4457 CFME: default certificate used across all installs 1350340 - Downloading the job templates of Anisble tower displays wrong data 1402992 - VM snapshot: revert option is enabled, for Active VM 1403358 - Add Provider->Type "RHEVM" should change to "RHV" 1414869 - VMRC is not working if IE compatibility mode is disabled 1419604 - [AnsibleTowerClient::ConnectionError]: Your license does not allow adding surveys 1428944 - Vulnerable JQuery Version 1430468 - Parent tenant displayed in list view when allowed by RBAC 1434152 - [RFE] Support for custom Amazon Regions in Provider 1434952 - delete action in /api/orchestration_templates results in error 1436074 - Back/Cancel buttton is missing on host drift comparison page 1436222 - The option of VM migration to the same host it is already running on is possible 1436226 - Persistent volume relationship link broken 1436228 - When the same action is used twice for a policy, action icons are inconsistent 1436232 - WebUI - Web Console button is enabled for archived vm's 1436233 - Container Provider - Capacity & Utilization: The page you were looking for doesn't exist 1436236 - Can't add provider specific catalog items to global region 1436237 - Event filter For Openstack::InfraManager 1436756 - when editing an existing user the field "Full Name" has the value of the field "Username" 1437146 - Policy conditions based on 'VM and Instance.vLANs' field not working 1437148 - [AWS][SDN] - Cannot edit or create Cloud networks/subnets 1437595 - Datepicker freezes after the first run of the "C & U Gap Collection". 1437909 - "Save" and "Reset" buttons are absent when adding log collection configuration 1437912 - Edit log collection menu has no spinner 1437925 - Policy to prevent a host scan request did not work 1438094 - [Regression] Azure provider refresh fails 1438866 - [VMWARE]Auto_placement provision fails due to selecting Host in Maintenance state 1439291 - Azure metrics collection failing with "MonitoringServiceException" 1439314 - service dialog can be submitted before entry point code on dynamic fields has completed execution 1439319 - SUI : Cockpit icon tooltip gets in the way of button click 1439789 - [RFE] Allow for template network interface type to be overwritten during a provision 1439945 - Vmware infra provider refresh fail 1440399 - UI: Hover text is overlapped by navigation menu on Topology 1440400 - UI: Hover text associated for button is not shown properly on Infrastructure Topology page. 1440401 - Unable to save automation task schedule using eastern time zone 1440402 - Policy to prevent a VM retire request did not work 1440701 - [RBAC] - Spinner when creating new role 1441199 - Error '[NoMethodError]: undefined method `base_model' for NilClass:Class' generating chargeback for container images report 1441202 - OpenShift Refresh duration exceeds default two hour timeout and grows > 8GB never fully completing 1441204 - Message timeout of 600 seconds does not allow perf_capture_timer to finish 1441251 - Unexpected error while executing a custom button 1441272 - queue_name_for_metrics_collection raises an exception when ems is nil 1441293 - Tag Visibility | Error: undefined method `base_class' for NilClass:Class on selecting container image on containers page 1441331 - appliance_console doesn't ask for database disk while setting secondy DB appliance 1441401 - Enable Central Admin UI has code artifact 1441648 - methods not sorted in frame on right side in automate 1441727 - Smartstate Analysis Error Unable to mount filesystem Unable to determine port used by VixDiskLib VMware 1441742 - When moving AWS provider from one zone to another Network Manager info no longer updates 1441752 - null result when deleting orchestration templates using REST API 1441754 - Get IP address automation code not working Azure 1441855 - OpenShift provider event storm POD_FAILEDSYNC 1442105 - UI: Topology - unable to confirm search by pressing the Return key, reacts only to a mouse click 1442156 - [SDN] - Disable CRUD actions for Azure/Amazon Network providers 1442164 - OSP refresh fail with Validation failed: Name can't be blank 1442169 - When using dynamic drop downs, sorting of items doesn't work in self service portal. 1442177 - EC2 provision dialogs do not support selecting multiple IPs for multi provision 1442764 - OpenStack refresh fail with nil:NilClass 1442769 - Rhev inventory refresh fails after rhev upgrade from 3.6 to 4.0 1442774 - Update oVirt SDK to version 4.1.z 1442865 - Automate import does not update display_name and description attributes in Namespace objects 1442877 - cloud_init re-runs on appliacne reboot, static networking configuration lost 1443246 - Clicking on Group or Role name link/icon in the user's details page does nothing 1443248 - Using REST API - encountering "NoMethodError: undefined method `key?' for #