Updated cfme packages that fix two security issues, several bugs, and addvarious enhancements are now available for Red Hat CloudForms 3.1.Red Hat Product Security has rated this update as having Important securityimpact. Common Vulnerability Scoring System (CVSS) base scores, which givedetailed severity ratings, are available for each vulnerability from theCVE links in the References section.
Red Hat CloudForms Management Engine delivers the insight, control, andautomation needed to address the challenges of managing virtualenvironments. CloudForms Management Engine is built on Ruby on Rails, amodel-view-controller (MVC) framework for web application development.Action Pack implements the controller and the view components.It was found that CloudForms Management Engine exposed SQL filters via theREST API without any input escaping. An authenticated user could use thisflaw to perform SQL injection attacks against the CloudForms ManagementEngine database. (CVE-2014-7814)It was found that the CloudForms Management Engine customization templateused a default root password for newly created images if no root passwordwas specified. (CVE-2014-3692)These issues were discovered by the Red Hat CloudForms Team.This update also fixes several bugs and adds various enhancements.Documentation for these changes is available from the Technical Notesdocument linked to in the References section.All cfme users are advised to upgrade to these updated packages, whichcontain correct these issues and add these enhancements.
Before applying this update, make sure all previously released erratarelevant to your system have been applied.This update is available via the Red Hat Network. Details on how to use theRed Hat Network to apply this update are available athttps://access.redhat.com/articles/11258Red Hat CloudForms 3.1
MD5: d86381047606af94c66fa419845a0371SHA-256: 706a11d774d4508840644699141f6352520761a80f3bbd2f4e0f277cbeb8b3ab
MD5: 6aec94c8a2a6bdee1df0bf47bbe36a7cSHA-256: 3558c6a975e9d61dff1621b7e5146dc8d32b0ae4b3ec1a48db3b946b40cf4749
MD5: 3b54e477514eb5a78536a70d59e9f3e6SHA-256: 155c84d8289328df89ab7dacd65cbff809718dcc35776d35b118ee949d1ad126
MD5: 7091dc5f3895a9bda9e76d52212c02eaSHA-256: c339fc3d3c47383c449450dbe7e36d6a60bb7d70f4cc15139dbaca4786c52ee5
MD5: ce439606eb994adaa88757157a1a0ae4SHA-256: 69e83f42ca8b22e7a5941451318b3492141a1735b049da9661894288350d1bab
MD5: 0b716b520087c7f1361f8abb75f8f3d9SHA-256: 206ab5b84cc99d81e97cb5609930e978baddccb053156f851653a7c7bf1789e4
MD5: 0c2b49f99c732870575093631de9e57fSHA-256: b4a4ea833d5b5008417925a82951c23e82555291ae03d6f12ac1e37f78c37ec4
MD5: 57750017ba21345878bf37e1bad29c53SHA-256: 21154eaf14f8d85f1c65c9f2d5825527ac3719ba0d017456ddbef05e2037ac97
MD5: ce7fb91fbd15246bea5b1f2b727f8d6dSHA-256: 2292f15c872527700a58719dcf09a5d9e952cda7e61c05103c8104437fadb3b8
(The unlinked packages above are only available from the Red Hat Network)
1145304 – All Passwords visible in UI when viewing page source1151258 – CVE-2014-3692 CFME: default fallback password in customization_templates.yml1157881 – CVE-2014-7814 CFME: REST API SQL Injection1161265 – Button triggered automate actions do not work1161761 – Automate Explorer: “Error during ‘save’: Validation failed: Datatype is not included in the list” when trying to save input parameters for a Method1162725 – Need to create the 5.3.2 (5.3.z) Advisory1163384 – UI: Missing route error for forest_delete action in Configuration/Configure/Settings/Authentication1163875 – RedHat domain – OSE automate model initial checkin.1164034 – Performance by Asset Type report undefined method error1164035 – [RFE] Need ability to properly override service request message.1164036 – Excon::Errors::Conflict]: Expected([200, 202]) <=> Actual(409 Conflict) with 2 security groups of the same name in the same tenant1165305 – Openstack inventory collection fails with missing instances1166214 – Callback url routing issue1166215 – Chargeback throws “undefined method ‘’ for nil:NilClass [configuration/form_field_changed]”1166286 – Setting start page as Clouds/Availability Zones shows “Page doesnt exist”1166290 – Text “Custom reports” displayed twice in import/Export Custom reports1168336 – UI: Missing routes error on Infra/Cloud Provider & Resource Pool list views when user has saved searches1168384 – Sorting and Paging does not work in Chargeback Rates list1168564 – UI: Unable to save a dashboard change after moving a widget to a different spot1170320 – Ext3 directory code should account for nil entries1170682 – Update miq_ae_service_snapshot.rb with new relationship of vm_or_template1170794 – Unable to create dashboard widget for trending reports or filter1171343 – Deleting a Cluster with many policy_events takes forever and times out.1171346 – ManageIQ – Resolve file differences resulting from model import/export round trip.1171821 – 22.214.171.124 doesn’t start evmserverd1171899 – Storage: Adding a new Storage Manager does not work. Crashes with the error – Error caught: [ArgumentError] wrong number of arguments (2 for 1)1172491 – Unable to schedule backup of internal vmdb_production DB using CFME console1179957 – ose_installer fails with uninitialized constant FileUtils1179959 – ose_installer fails with No such file or directory – /root/.openshift/oo-install-cfg.yml
These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from: