RHBA-2015:0054 - Bug Fix Advisory

Topic

Updated the following packages to fix several bugs in Red Hat Satellite 6:

foreman
foreman-proxy
katello-agent
pulp
pulp-nodes
pulp-puppet
pulp-rpm
ruby193-rubygem-fog
ruby193-rubygem-foreman-tasks

packages. These packages are now available in Red Hat Satellite 6.

Description

Red Hat Satellite is a system management solution that allows organizations to
configure and maintain their systems without the necessity to provide public
Internet access to their servers or other client systems. It performs
provisioning and configuration management of predefined standard operating
environments.

This update fixes the following bugs:

• BZ1107690 When cloud_init attempts to contact Foreman to complete the

phone_home action, it fails with a HTTP 500 error due to incorrect data being
transmitted in the POST header. To rectify this error, post settings are now
being cleared when attempting to complete the phone_home action.

• BZ1119910 katello-installer fails to execute when the host system has

restrictive umasks. The restrictive umasks affects permissions and access to the
keystore and certain cert files. This fix will set the umask to the required
value for installation to make sure that the installation goes through properly.

• BZ1128296 When synchronizing content, the User Interface fails to complete the

synchronization process and hangs indefinitely, despite the pulp logs
registering errors. This error was caused by an incomplete URL. All URL
parameters must contain the full address and requires the "http" or "https"
protocol. Pre-validation checks have been implemented to check the proxy URL and
provide an error message should the proxy URL fail to comply with the
requirements.

• BZ1139152 katello-remove fails to remove the ruby193-rubygem-foreman-tasks

package on a RHEL 7 system because of preun script errors related to turning off
services. The preun script used the chkconfig command to turn off tasks which is
not compatible with RHEL 7. This fix corrects the preun script to include the
correct commands for different RHEL versions. katello-remove should correctly
remove the package.

• BZ1142861 When provisioning a VMWare virtual machine that is in a cluster in a

folder, the provisioning process fails with the error "Failed to create a
compute VMWare (VMWare) instance client.example.com: cluster is required for
this operation". Red Hat Satellite could not detect clusters within folders.
This fix adds support for clusters located below folders as well as VMWare
machine setups in a non-clustered environment.

• BZ1152720 Foreman Smart Proxy failed to verify SSL certificates. This permits

any client with access to the API to make requests and perform actions. Foreman
Smart Proxy now runs a check on SSL certificates to verify identity, forbidding
HTTPS requests when there is no client SSL certificate.

• BZ1159327 On a Satellite server using an http proxy connection, selecting

repositories fails with an SSL_connect error. Some proxy servers do not support
SSLv23 and TLS 1.2 which Red Hat Satellite requires. To fix this issue,
Satellite now allows the administrator to specify a SSL version via the
/etc/foreman/plugins/katello.yaml.

• BZ1165301 When executing a daily sync plan, the synchronization process freezes

with "Sync Incomplete" resulting in pulp errors in the log file. The error
occurs when the downloaded packages are
being verified wherein the checksum_type is being reported as SHA while pulp
explicitly handles SHA1. To fix this issue, the verification process returns the
"SHA" value to "SHA1" to comply with pulp requirements.

• BZ1168010 On a RHEL 7 system, ruby upgrades changed the accepted format for

io.popen resulting in ssh puppet commands being incorrectly formatted. This
prevented the commands from executing. The format has been corrected in this
fix.

• BZ1173228 RHEV/ovirt instances with non self-signed server certificates could

not connect to the Satellite server. To fix this issue, the CA field has been
changed to an editable field so that administrators can provide the correct CA
or CA chain in the correct order.

All Red Hat Satellite 6 users are advised to upgrade to these updated packages
to resolve the bugs above.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

This update is available via Red Hat Subscription Management. Details on how to use Red Hat Subscription Management are available at https://access.redhat.com/articles/433903.

NOTE: This update requires additional steps to complete beyond just installing new packages. To complete this update please follow the steps outlined below:

To update your Satellite or Capsule with this or other errata please follow these instructions:

SATELLITE SERVER

I. Shut down all Satellite related services. During this time managed hosts will not be able to install packages or apply configuration, so plan accordingly.

# katello-service stop
Shutting down Katello services...
Stopping httpd: [ OK ]
celery init v10.0.
...

II. update packages via yum

# yum clean all
# yum update

This step will download and install any available Satellite errata as well as any other pending updates (such as RHEL) to Satellite 6 server. Review the list of packages being updated and accept with Y/N

III. Perform data migration

# service mongod start
# sudo -u apache pulp-manage-db
# katello-service start
# foreman-rake katello:reindex

these steps may take some amount of time, let them run to completion. After the last command is complete your Satellite is ready for use.

CAPSULE SERVER

I. Stop all services: The Satellite Capsule currently lacks a wrapper utility to start/stop all associated services so they must be stopped manually. See this article to see how to stop all services:

# for i in pulp_celerybeat pulp_resource_manager pulp_workers httpd foreman-proxy; do service $i stop; done

II. update packages via yum

# yum clean all
# yum update

This step will download and install any available Satellite Capsule errata as well as any other pending updates (such as RHEL) to Satellite 6 Capsule server. Review the list of packages being updated and accept with Y/N

III. Perform data migration

# sudo -u apache pulp-manage-db

this step may take some amount of time, let it run to completion.

III. Restart services:

# for i in pulp_celerybeat pulp_resource_manager pulp_workers httpd foreman-proxy; do service $i start; done

Affected Products

• Red Hat Satellite 6.0 for RHEL 7 x86_64
• Red Hat Satellite 6.0 for RHEL 6 x86_64
• Red Hat Satellite Capsule 6.0 for RHEL 7 x86_64
• Red Hat Satellite Capsule 6.0 for RHEL 6 x86_64

Fixes

• BZ - 1107690 - Cloud-init phone_home raise 500 error because of POST content
• BZ - 1119910 - katello-installer errors if umask too restrictive
• BZ - 1128296 - Content sync should not silently hang/fail due do to possibly malformed proxy url
• BZ - 1139152 - yum remove ruby193-rubygem-foreman-tasks produces preun errors on RHEL 7, causing katello-remove to not work properly
• BZ - 1165301 - PLP0000: [Errno 17] File exists (Katello::Errors::PulpError) trying to sync repos on multiple instances
• BZ - 1168010 - PuppetSSH fails on RHEL 7
• BZ - 1173228 - RHEV/oVirt compute resource should have CA text field editable

CVEs

• CVE-2014-3691

References

• http://www.redhat.com/security/updates/classification/#normal