RHSA-2015:1592 - Security Advisory

Topic

Red Hat Satellite 6.1 now available for Red Hat Enterprise Linux 6.

Description

Red Hat Product Security has rated this update as having an important
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.

Red Hat Satellite is a system management solution that allows organizations
to configure and maintain their systems without the necessity to provide
public Internet access to their servers or other client systems. It
performs provisioning and configuration management of predefined standard
operating environments.

This update provides Satellite 6.1 packages for Red Hat Enterprise Linux 6.
For the full list of new features provided by Satellite 6.1 see the Release
notes linked to in References section. (BZ#1201357)

It was discovered that, in Foreman, the edit_users permission (for example,
granted to the Manager role) allowed the user to edit admin user passwords.
An attacker with the edit_users permission could use this flaw to access
an admin user account, leading to an escalation of privileges.
(CVE-2015-3235)

It was found that Foreman did not set the HttpOnly flag on session cookies.
This could allow a malicious script to access the session cookie.
(CVE-2015-3155)

It was found that when making an SSL connection to an LDAP authentication
source in Foreman, the remote server certificate was accepted without any
verification against known certificate authorities, potentially making
TLS connections vulnerable to man-in-the-middle attacks. (CVE-2015-1816)

A flaw was found in the way Foreman authorized user actions on resources
via the API when an organization was not explicitly set. A remote attacker
could use this flaw to obtain additional information about resources they
were not authorized to access. (CVE-2015-1844)

A cross-site scripting (XSS) flaw was found in Foreman's template preview
screen. A remote attacker could use this flaw to perform cross-site
scripting attacks by tricking a user into viewing a malicious template.
Note that templates are commonly shared among users. (CVE-2014-3653)

It was found that python-oauth2 did not properly verify the nonce of a
signed URL. An attacker able to capture network traffic of a website using
OAuth2 authentication could use this flaw to conduct replay attacks
against that website. (CVE-2013-4346)

It was found that python-oauth2 did not properly generate random values
for use in nonces. An attacker able to capture network traffic of a website
using OAuth2 authentication could use this flaw to conduct replay attacks
against that website. (CVE-2013-4347)

Red Hat would like to thank Rufus Järnefelt of Coresec for reporting the
Foreman HttpOnly issue.

All users who require Satellite 6.1 are advised to install these new
packages.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Full upgrade instructions are available in the Satellite 6.1 Installation
Guide:
https://access.redhat.com/documentation/en-US/Red_Hat_Satellite/6.1/html/Installation_Guide/chap-Upgrading_Red_Hat_Satellite_and_Capsule_Server.html

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Satellite 6.1 for RHEL 6 x86_64
• Red Hat Satellite Capsule 6.1 for RHEL 6 x86_64

Fixes

• BZ - 842293 - [RFE] add CLI command to install errata on system
• BZ - 873311 - [RFE] Org level permission to manage users
• BZ - 883170 - [RFE] Allow --label when creating environments from the CLI
• BZ - 909996 - [RFE] display more descriptive error pages for invalid URLs
• BZ - 910078 - Errata info CLI query too complex
• BZ - 973826 - [rfe] Ability to clone a Provisioning template
• BZ - 976275 - Pages that have Pulp content take 4-5+ minutes to respond if there are a large number of repos
• BZ - 980113 - The WebUI does not degrade nicely on screen width smaller than 1090 pxs
• BZ - 1007746 - CVE-2013-4346 python-oauth2: _check_signature() ignores the nonce value when validating signed urls
• BZ - 1007758 - CVE-2013-4347 python-oauth2: Uses poor PRNG in nonce
• BZ - 1009578 - RHEL 5 custom content without a FEED is not consumable by RHEL 5 clients
• BZ - 1010575 - [RFE] Support deep merging of hash structures in smart class parameters
• BZ - 1016874 - Candlepin events not being returned
• BZ - 1019227 - auto-attach control does not work from client in CLI
• BZ - 1023062 - Architectures etc: resources created/modified should not use multibyte names in URLs
• BZ - 1024539 - Editing an oVirt compute resource allows changing the type, which is unsupported
• BZ - 1031001 - Invalid pulp yum_importer.json can be written with missing --proxy-* arguments
• BZ - 1037729 - No errata data from Oracle repos
• BZ - 1052257 - [RFE] Make default root password encryption be SHA256
• BZ - 1070730 - User email validation doesn't exactly match specification
• BZ - 1076568 - Org delete fails in hammer and UI with API error
• BZ - 1079975 - suggested command do not work when created new trend counter
• BZ - 1083184 - it takes too long to display first environment checkbox when promoting content view version
• BZ - 1085406 - the UI is really uninformative about pulp's initial gyrations when syncing
• BZ - 1085417 - CLI: A number of info command doesn't work if you pass them bad ids
• BZ - 1088751 - [RFE] Allow override of smart class parameter without specifying or forcing a default value
• BZ - 1091494 - hammer cli does not follow env paths while promotion
• BZ - 1093180 - [RFE] Display helptip for activation keys
• BZ - 1093347 - unable to advance through paged results from hammer subscription list
• BZ - 1093483 - Error link from failed repository sync gives me a spinner
• BZ - 1093766 - Error message references search which is not intuitive
• BZ - 1096407 - Creating a sync plan from the web UI always uses the time when you first opened the page
• BZ - 1096952 - Content dashbard: Text in dropdowns is white on white/light grey and very hard to read
• BZ - 1098183 - Using dots in kickstart template names or hostgroups causes routing errors
• BZ - 1098425 - [RFE] Updating the system limit below to already consumed should throw a validation error
• BZ - 1098704 - editing resources in UI returns view to wrong page and search
• BZ - 1098709 - org admin user cannot visit Configure -> Puppet Classes UI page
• BZ - 1100344 - unable to set compute-resource's "Console passwords" option via hammer
• BZ - 1101093 - production.log should have timestamps in it
• BZ - 1102284 - hammer content-view version promote should have friendlier options
• BZ - 1102296 - Content view info command doesn't display any association data (content hosts, activation keys, etc)
• BZ - 1102732 - exposing DB tables when listing roles via API
• BZ - 1103862 - organization and location options missing from hammer commands
• BZ - 1103865 - activation keys UI - missing reference list
• BZ - 1103871 - add method for adding plugin routes to bastion
• BZ - 1103944 - Need to be able to associate gpg key to a repository by gpg key name
• BZ - 1104175 - When publishing content view, it always shows same next version number
• BZ - 1104638 - hammer content-hosts and activation-keys missing content override
• BZ - 1104781 - Capsule installer 'succeeds' very quickly (but fails with no error) if system is not registered.
• BZ - 1105773 - Going to /api/v2 should show me all apis for plugins and main foreman server
• BZ - 1108172 - Typo in dynflow logging.
• BZ - 1108317 - Puppet syncs through dynflow show no progress
• BZ - 1110360 - Can't search for host with class inherited from config group
• BZ - 1110431 - Satellite6 should error when the user attempts to sort on a non-sortable field
• BZ - 1110475 - Four of the activation-key commands accept only activation-key id missing activation key name, organization, organization-id, organization-label arguments
• BZ - 1111240 - CLI: Still seeing references to "system" in the CLI
• BZ - 1111254 - puppet-module --id vs --uuid inconsistency
• BZ - 1111310 - Hammer product set-sync-plan provides both --sync_plan_id and --sync-plan-id options
• BZ - 1111711 - [RFE] Implement spinner for Activation key -> Product Content tab
• BZ - 1112112 - roles: auto search should be enabled for all katello related resource types.
• BZ - 1112182 - top level menu item "Content" visible to normal user without any permission
• BZ - 1112234 - roles: publishing a CV via normal user raises NetworkError: 403 Forbidden - /foreman_tasks/api/tasks/bulk_search" bulk_search
• BZ - 1112247 - We lose sorting, when we edit some provisioning template.
• BZ - 1112563 - roles: content-search doesn't show packages to normal user, who has permission to view_product
• BZ - 1112607 - Foreman-tasks EXECMEM denial
• BZ - 1112657 - roles need to allow email address and i18n as name
• BZ - 1112747 - Activation key product content changes aren't reflected in the UI
• BZ - 1112782 - UI: Repository: "Sync Now" available on a feedless repository
• BZ - 1114136 - hammer org update org's description is broken
• BZ - 1114860 - With no datacenters, error should be shown when creating VMWare compute resource
• BZ - 1115602 - [RFE] Subcription Events need to be consumed by katello
• BZ - 1117342 - Default location detection broke with name change
• BZ - 1117376 - Publish/Promotion times in Satellite 6 growing after each publish/promotion
• BZ - 1117636 - CV: Clicking on 'Here' link while removing CV version, continuously refreshes the page
• BZ - 1117952 - db:seed after renaming default Organization fails (and probably location too)
• BZ - 1117964 - [RFE] Support downloading and storing docker images in pulp
• BZ - 1118102 - Add an installer flag to clear puppet environments from disk
• BZ - 1120280 - API doc for "Repositories" is incomplete
• BZ - 1120314 - Error when creating a repository with no name: undefined method `gsub' for nil:NilClass
• BZ - 1120657 - Adding two OS parameters with same name doesn't raise any error when values are different
• BZ - 1120710 - Sync Status start time and result progress bar get out of sync
• BZ - 1120730 - Dupe errors when creating a content host without a name
• BZ - 1120765 - Slow UI (>20seconds to load page) Composite Content-view -> Adding Content Views
• BZ - 1120903 - [RFE] pulp worker count needs a maximum
• BZ - 1121097 - `katello-installer --help` mentions default twice for some options
• BZ - 1121098 - `katello-installer --help` for "--foreman-authentication" mentions admin/changeme
• BZ - 1121516 - Template: deleting a template with only spaces and quote characters in the name fails
• BZ - 1121536 - Template: PGError: when comments in "audit comment" exceeds 255 characters
• BZ - 1121753 - In content view history, descriptions entered during publishing are not shown
• BZ - 1121755 - Cannot edit host group if its name only contains UTF-8 characters
• BZ - 1121938 - Long names needs to be truncated while listing
• BZ - 1121959 - Package upload fails with larger rpms (30MB+) in UI with "Error during upload: undefined"
• BZ - 1121972 - creating a medium with single whitespace(" ") shouldn't be allowed
• BZ - 1122167 - Using hostgroup puppet-classes generates error
• BZ - 1122188 - CLI command lifecycle-environment paths generates error
• BZ - 1122647 - Associate resources by name
• BZ - 1122650 - [RFE] JSON and/or YAML structured output adapters
• BZ - 1122658 - Config templates cannot be assigned to a taxonomy from config_template#edit
• BZ - 1122715 - hammer activation-key allows -1 and text inputs for max-content-hosts
• BZ - 1122716 - hammer host-collection fails to set specified host collection limit
• BZ - 1122828 - Both locations and organizations shown in search autocomplete
• BZ - 1123352 - cannot edit compute resource if its name contains UTF8
• BZ - 1123360 - creation of domain parameters with same name is possible.
• BZ - 1123388 - Can not edit architecture if it name contains utf-8 characters
• BZ - 1123478 - Command completion does not work on hammer shell
• BZ - 1123519 - JavaScript syntax error when displaying hosts for organization: Error: Syntax error, unrecognized expression: %22Default_Organization%22'
• BZ - 1123815 - subnet name char limit is capped to 238 instead of 255
• BZ - 1123818 - location char name is capped to 246 instead of 255
• BZ - 1123868 - [RFE] Missing search option for template kinds
• BZ - 1124061 - hammer: Unable to add repository to content view
• BZ - 1124386 - PXE default menu doesn't honour unattended_url setting
• BZ - 1124435 - Editing host shows an organization/location when none is set on the host
• BZ - 1124912 - hammer host-collection: --organization-id is missing help text
• BZ - 1124923 - Sync Mgmt and Content->Product sync hides CDN errors; needs better messaging/error reporting
• BZ - 1125003 - API error while creating a new OperatingSystem with incorrect data types
• BZ - 1125241 - Cannot specify initial Organization or Location via Katello installer
• BZ - 1125330 - Monitor Overview Host Configuration graph refers to incorrect URL
• BZ - 1125354 - Dynflowize product update
• BZ - 1125394 - Add an installer flag to clear pulp binary content from disk
• BZ - 1125395 - after lifecycle environment and content view are selected, default to associated puppet environment but have option to change it
• BZ - 1125399 - Dynflow actions that hit Candlepin should use the username not remote_id for the cp-user header
• BZ - 1125447 - New Compute Resource page is missing HTML title
• BZ - 1125831 - PGError: ERROR: bigint out of range: on setting entries_per_page to long integer value
• BZ - 1126033 - Puppet environment cannot be edited when name is only numeric
• BZ - 1126087 - content_source doesn't work with host group-based provisioning
• BZ - 1126145 - rake db:seed failure on creating organization
• BZ - 1126446 - require sync plan interval on new sync plan?
• BZ - 1126473 - puppet class with numeric name can neither be edited nor deleted.
• BZ - 1126570 - [RFE] Provide means to see a systems 'available' and 'applicable' errata
• BZ - 1126924 - [RFE] some form of activation key that contains subscription groups rather than exact subscriptions needed
• BZ - 1126937 - Add @provisioning_type variable to tell when provisioning with a host group
• BZ - 1126961 - Satellite 6 does not provide a way to search content based on CVE/MITRE/OVAL data
• BZ - 1127090 - ActivationKey: UI raises misleading validation error on updating the content-host limit from finite number to 'unlimited'
• BZ - 1127397 - Running the installer a second time with no proxy values creates an invalid config
• BZ - 1127408 - hammer repository info failed
• BZ - 1127447 - Hitting Cancel button on New Org > Manually Assign page goes to 404 page
• BZ - 1127454 - Move default org and location dropdowns to same tab as org/loc selections
• BZ - 1127589 - API Missing routes for repositories
• BZ - 1128069 - Wrong count shown on hosts\architectures 1 should be 5
• BZ - 1128469 - Calendar icon not functional in Errata by ID content view filter page
• BZ - 1128796 - repos without a feed-url can be synced via products
• BZ - 1129090 - GPG key displayed incorrectly (twice escaped?)
• BZ - 1129094 - SELinux AVCs when installing on RHEL 6.6
• BZ - 1129202 - PGError when hostgroup name exceeds 245 characters
• BZ - 1129262 - compute resource info Error: can't convert nil into Array
• BZ - 1129526 - [RFE] Implement spinner for redhat repos page
• BZ - 1129616 - Adding new RPMs to a product repository reports wrong number of RPMs on the published content view
• BZ - 1129635 - Deleting a resource and creation a new one might lead to conflicts when the deletion is not finished yet
• BZ - 1130157 - Virtual machine settings can't be reviewed on cloned host
• BZ - 1130224 - Errata - Date and Content filter does not maintain changes
• BZ - 1130300 - sync plan shows "never synced" for a repository even though it has been manually synchronised
• BZ - 1130327 - Content Dashboard - Sync Overview displays items in random order
• BZ - 1131206 - hammer composite content view create ignores component-ids
• BZ - 1131238 - hammer host-collection create/update ignores content-host-ids
• BZ - 1131416 - On creating hostgroup with html tags, UI appends the closing tag and string in name and converts it to link
• BZ - 1131455 - accessing the subscription[products] link from activation_key should display custom products subscriptions and not move to manifest subscriptions page
• BZ - 1131538 - [RFE] Update the RH Access plugin in Satellite 6.1
• BZ - 1131549 - root password length should be labeled as "must" instead of should
• BZ - 1131555 - When creating a host cant is spelled wrong under partition table side note
• BZ - 1131659 - Cannot create host if the domain name starts with "."
• BZ - 1131661 - sync plan start time is incorrectly claiming that is accepts GMT
• BZ - 1131668 - Some foreman options are removed after katello-installer runs
• BZ - 1131911 - hammer user create --admin help output not intuitive
• BZ - 1131955 - Instalation (load_policy) throws write selinux denial
• BZ - 1132017 - subscription details is missing virtual guest subscription and required host information
• BZ - 1132174 - hammer product remove-sync-plan - Remove unused options
• BZ - 1132507 - [RFE] The binary foreman-prepare-realm has no man page
• BZ - 1132509 - foreman-proxy spec file is using incorrect format
• BZ - 1132572 - Enabling some iso repos failed
• BZ - 1132576 - Syncing an iso repo throws error in foreman/production.log
• BZ - 1132665 - User w/o view host permission can access /hosts UI page
• BZ - 1132675 - Edit organization displays associated resources for use w/o permissions
• BZ - 1132676 - Any hammer command which shows progress bar in output will work only for the first time
• BZ - 1132817 - Sync plan
• BZ - 1132914 - Duplicate route sync plan
• BZ - 1133113 - Information about host collection limit is incomplete when looking at content host
• BZ - 1133245 - content-host errata apply gives success message for an invalid errata id
• BZ - 1133557 - [RFE] There's no way to view packages in the CLI
• BZ - 1133568 - [RFE] There's no way to view errata in the CLI
• BZ - 1133679 - unable to modify user in UI as it incorrectly states "Administrator cannot be removed from the last admin account"
• BZ - 1133799 - nil allowed as user parameter at user creation
• BZ - 1133845 - Admin user should have default org by default
• BZ - 1134100 - When publishing/promoting CV, while capsule exists, content gets synced twice to capsule
• BZ - 1134109 - Satellite 6 Diagnostics Tooling: need foreman-debug or equivalent for Capsule
• BZ - 1134493 - [RFE] hammer cli neither provides auth-source nor auth-source-id
• BZ - 1134737 - Improve SELinux sosreport/foreman-debug
• BZ - 1135125 - hammer provides no host-collection content-management
• BZ - 1135474 - organizations UI "Mismatches Report" shown w/o view hosts permission
• BZ - 1135513 - [RFE] ability to remove puppet module from repository
• BZ - 1135651 - Host Create API documentation missing required parameters
• BZ - 1135919 - Unable to filter on classes (v1.5.2)
• BZ - 1135989 - Installation occasionally fails: failed to call refresh: /usr/sbin/foreman-rake db:seed returned 1 instead of one of [0] with "Validation failed: Name has already been taken" in katello-installer.log
• BZ - 1136002 - Hostgroup provisioning provides HTTPS URL
• BZ - 1136056 - Unable to unregister with subscription-manager < 0.96 (RHEL 6.1, RHEL 5.7)
• BZ - 1136088 - subnet mask validation
• BZ - 1136282 - `foreman-rake bootdisk:generate:generic` fails with: Permission denied - bootdisk_<fqdn>.iso
• BZ - 1136292 - [RFE] add hammer_cli_foreman_bootdisk package
• BZ - 1136369 - `foreman-rake bootdisk:generate:host NAME=foobarbaz.katellolabs.org` fails with "undefined method 'empty?' for NilClass::Jail (NilClass)"
• BZ - 1138324 - bastion js looks for 'import_subscriptions' permission, but server defines 'import_manifest'
• BZ - 1138411 - Content Dashboard UI not displaying any data
• BZ - 1138868 - Firebug error on selecting content hosts in UI
• BZ - 1139576 - creating/updating activation-key with long integer value under content-host limit raises PGError: integer out of range
• BZ - 1139616 - userids created with lower and upper case chars cannot login via webUI
• BZ - 1139896 - synced RPMs do not have their checksums verified
• BZ - 1139903 - [RFE] searching users by role_id not supported
• BZ - 1140313 - Cannot read an auth source ldap's host via the API
• BZ - 1140553 - hammer --help redundantly requires credentials
• BZ - 1140675 - subscription-manager register fails with undefined local variable or method 'query_params'
• BZ - 1141671 - Cant specify comma spaced lists as values to the --parameters option.
• BZ - 1142160 - Unable to use cloned PXELinux global default template with 6.0.4
• BZ - 1142173 - Tooltip for storage/network sections stays visible in Edit Compute Profile
• BZ - 1142550 - [ja_JP] Redundant blank or space between the string of 'New Location' or 'New Organization' button and page.
• BZ - 1142763 - [de_DE]: Text truncation observed on product details page.
• BZ - 1142878 - [RFE] Support for non-clustered VMware hypervisors
• BZ - 1143859 - [CCJK] Unlocalized period next to the end sentence 'Red Hat Repositories page' locations' link in Activation Key->Product Content tab.
• BZ - 1143917 - [de_DE, fr_FR]: Rendering of special characters appears different
• BZ - 1144215 - Cannot log out of WebUI from mobile device
• BZ - 1145146 - mkdir: cannot create directory `/var/lib/rpm-state/foreman-proxy': No such file or directory while upgrading to foreman-proxy-1.6.0.8-1.el6sat.noarch
• BZ - 1145244 - Cannot select puppet classes when creating new Host Group
• BZ - 1145398 - CVE-2014-3653 foreman: cross-site scripting (XSS) flaw in template preview screen
• BZ - 1145626 - [RFE] Javascript validation of passwords on Edit User screen
• BZ - 1145630 - 'Displaying x entries' button doesn't seem to do anything
• BZ - 1145637 - OS Family web UI is handled uniquely in three different places
• BZ - 1145639 - Inconsistent terminology around Login vs Sign Out
• BZ - 1145641 - Ordering within the Logged in user menu should be flipped
• BZ - 1145742 - [RFE] Support case, cant specify level of support
• BZ - 1145858 - [zh_CN] Localized string broken for 'Loading' page.
• BZ - 1145964 - Disable --foreman-plugin-discovery-install-images option
• BZ - 1145967 - When creating "New Host", "New" string is not translated
• BZ - 1147049 - Passing empty values to katello-installer proxy settings creates invalid JSON
• BZ - 1148363 - hammer help command typos
• BZ - 1148488 - satellite UI should show "Loading" while loading the puppet modules in a content view
• BZ - 1148754 - CLI - content hosts limit of activation key is not listed
• BZ - 1151048 - using qemu+ssh for a libvirt CR results in selinux denials
• BZ - 1151093 - attempting to login in via LDAP auth source configured in Sat 6 on RHEL 7 gives connection error
• BZ - 1151240 - Some API URLs emit a list of IDs, and others emit a list of hashes.
• BZ - 1151618 - Unable to register a client to nightly
• BZ - 1151633 - save button does not enable when creating a new sync plan in nightly
• BZ - 1152238 - Nested location are not shown as nested
• BZ - 1152470 - [Activation_key] add_subscription command failing with exception: Missing arguments for 'subscriptions'
• BZ - 1152715 - capsule-certs-generate defaults to ACME_Organization instead of Default_Organization
• BZ - 1153034 - Hammer host creation - no way to set organization or location
• BZ - 1153060 - Discovery can possibly set wrong default route
• BZ - 1153943 - NIghtly Katello install is failing
• BZ - 1154156 - /api/v2/hosts rejects POST request containing operatingsystem_id parameter
• BZ - 1154187 - UTF8 Characters are stripped from links
• BZ - 1154380 - Inconsistent Selector Actions on the Errata Page for a Content Host
• BZ - 1154619 - It's not possible to add a subscription on an activation key
• BZ - 1155237 - Missing Checksum type value in hammer repository info
• BZ - 1156555 - Can set a bad max_content_hosts value when unlimited_content_hosts is true
• BZ - 1156629 - Make hammer content-view info output consistent
• BZ - 1158620 - /katello/api/v2/systems does not return an organization ID
• BZ - 1158918 - subnet not matching domain available as choice when creating new host
• BZ - 1160740 - "Apply Selected" errata workflow does not have an "Are you sure?" check
• BZ - 1160804 - disable SSLv3 for foreman-proxy
• BZ - 1160847 - hammer import config-file doesn't handle rhn.system.net_interface.* macros correctly
• BZ - 1161140 - Associating image to Openstack CR fails undefined method `downcase' for nil:NilClass
• BZ - 1161642 - As a user, I wish to add guest subscriptions from different hypervisors to a single activation key
• BZ - 1161809 - Mail notifications should be branded
• BZ - 1162061 - API list puppet_modules does not work
• BZ - 1162259 - New Container "next" button is enabled when no Docker computer resource exists.
• BZ - 1162297 - candlepin-0.9.23-1.el7.src.rpm explicitly sets Vendor:
• BZ - 1162541 - Katello installer doesn't install katello package
• BZ - 1162799 - Cannot add a puppet module to a content view by name
• BZ - 1164164 - Setting a katello-proxy-url on RHEL7 in enforcing mode causes AVC denials: name_connect
• BZ - 1164671 - sync_interval sets as blank by default when creating a sync_plan and doesn't allow to create it
• BZ - 1165043 - facts feature should not be enabled by default
• BZ - 1165151 - hammer import content-view is failing with "Error: can't convert nil into Integer"
• BZ - 1165174 - configuring default_capsule is broken on nightly via katello-installer
• BZ - 1165306 - [RFE] Add BMC interface to "Discovered Host" entry during foreman-discovery image
• BZ - 1165470 - Content Search: Package search does not return any results for packages starting with capital letters.
• BZ - 1165642 - Promoting CVs with hammer results in error when referencing environment by name
• BZ - 1165748 - Can not install Satellite 6.0.6 on RHEL 7.1 because rubygem-rkerberos dependency krb5-libs was updated in RHEL 7.1
• BZ - 1165935 - Typo and confusion in man page
• BZ - 1166157 - [RFE] Add support for bond interfaces
• BZ - 1166158 - [RFE] In host's edit page, show the source for the value of puppet class parameters
• BZ - 1166159 - [RFE] API v2 - nested routes for each controller
• BZ - 1166161 - cannot change parent of hostgroup
• BZ - 1166162 - [RFE] Expose network configuration via ENC
• BZ - 1166163 - [RFE] Add ancestry NICs and allow interfaces with same MAC
• BZ - 1166165 - [RFE] mark required fields in form
• BZ - 1166167 - Set token_duration to 6 hours instead of one hour
• BZ - 1166307 - Content search: content view compare seems to hang indefinitely and/or eventually not respond to click
• BZ - 1166365 - Deleting a repo should either block until done or return a task
• BZ - 1166889 - As a user, I should be able to set auto attach flag on an activation key when I create it
• BZ - 1167261 - Nightly installation failing: foreman-rake-db:migrate: cannot load such file -- v8
• BZ - 1167417 - Content View Versions page takes a long time to list
• BZ - 1167788 - Adding a puppet class with non US-ASCII characters makes Satellite unusable
• BZ - 1168061 - Moving Satellite from one OS to another OS causes operatingsystem < 0
• BZ - 1168457 - Using IE 11, cannot promote items on Satellite 6
• BZ - 1169289 - [RFE] validate custom certificates before Satellite 6 installation
• BZ - 1169416 - gofer does not try to reconnect after network issue
• BZ - 1169946 - hammer Erratum list fails
• BZ - 1170276 - Provisioning fails with VMware Compute Resource if the vCenter's datacenter is using nested folders.
• BZ - 1171092 - API Delete activation key does not respond with content
• BZ - 1171173 - Too many queries to list products - Satellite 6 - Slow Response Time
• BZ - 1171181 - Content View Errata by ID filter 'List/Remove' tab errors
• BZ - 1171310 - Usability: Align the display of errata icons in Content Host and Content Host Details page
• BZ - 1171669 - Updating host-collection using only id is failing
• BZ - 1172260 - Any puppet class created with a '.' is not deletable or able to change.
• BZ - 1172836 - Session reset after each page request, idle_timeout set to zero
• BZ - 1172839 - Capsule will not register to Satellite 6.1.0 on RHEL 6
• BZ - 1172842 - Satellite 6.1.0 installer fails trying to start httpd if selinux is enabled
• BZ - 1172843 - hammer fails to run on RHEL 6 in Satellite 6.1.0
• BZ - 1173340 - [RFE] As a SAM user, I should not see references to custom products
• BZ - 1173723 - content-override does not produce an error when --label is missing
• BZ - 1173724 - Copying an activation key does not include auto-attach preference
• BZ - 1173764 - "Upload Package" section of Product -> Repositories UI should not be displayed for Red Hat products
• BZ - 1173765 - Disable bulk action checkboxes on any pages that do not support them.
• BZ - 1174932 - As a SAM user, I should not see references to remote actions
• BZ - 1174944 - As a SAM user, I should not see references to lifecycle environments
• BZ - 1175425 - [RFE] As an API user, I would like to view the content of a Docker repository.
• BZ - 1175620 - Cannot sync EPEL in Satellite 6
• BZ - 1175803 - [RFE] Client Qpid traffic should be routable through the client's Capsule.
• BZ - 1177377 - Satellite 6.1 does not work with http proxy due to SELinux denials
• BZ - 1177609 - Content View index page takes a long time to list
• BZ - 1177904 - After removing a product from a sync plan, repos from the product are still synced according to the plan
• BZ - 1178206 - Content > Sync Status: Don't need a period after "Only show syncing."
• BZ - 1178928 - Unable to update activation key by id
• BZ - 1179448 - Katello API throws an incorrect error when receiving non-json requests
• BZ - 1179449 - foreman-debug does not include tomcat logs
• BZ - 1179457 - Typo on Trends page
• BZ - 1179462 - Search does not work on Content host errata tab
• BZ - 1179465 - Incorrect errata count displayed on Content host Details page
• BZ - 1179473 - Redundant help text in host-collection erratum install
• BZ - 1179827 - Typo on Content View Publish New Version screen
• BZ - 1180051 - Make puppet ssl certificate+key that is used to authenticate against foreman available to the smart-proxy
• BZ - 1180285 - Auto attach is not included in activation-key info output
• BZ - 1180354 - Errata Details Page: Show N/A if CVE information is not present
• BZ - 1180666 - Deploy foreman_url setting for proxy configuration
• BZ - 1181237 - Unable to access any page under content menu
• BZ - 1181461 - Install discovery plugin and smart proxy plugin by default
• BZ - 1181694 - [RFE] foreman-prepare-realm should support FreeIPA 4
• BZ - 1181707 - katello-installer fails to configure
• BZ - 1182195 - Puppet Environment drop down not updated when editing Host Group
• BZ - 1182325 - Satellite 6.1.0 Content pages are blank
• BZ - 1182604 - Rename "Available Errata" to "Installable Errata"
• BZ - 1183012 - Install the ABRT plugins
• BZ - 1183127 - Allow connections to Docker
• BZ - 1183643 - Smart class parameters with ERB snippets are broken for other that String types
• BZ - 1184834 - foreman-debug does not contain main mongodb logfile
• BZ - 1185318 - Permission Denied message seen when providing roles to user_groups
• BZ - 1185401 - celery.worker.consumer:ERROR: consumer: Cannot connect to qpid
• BZ - 1185801 - Satellite 6 is prevented from connecting to AMQP (qpidd)
• BZ - 1186321 - Provide a kickstart provisioning template to configure networking
• BZ - 1186353 - Composite content view publish puppet module by specified version (uuid) not working
• BZ - 1186440 - unable to access UI after installing foreman_openscap package
• BZ - 1186859 - compute profile network interfaces do not show libvirt network options
• BZ - 1186942 - About page opens duplicate tabs for each link you click
• BZ - 1186974 - Creating a composite initially sends you to a page to add components that is empty
• BZ - 1187011 - registering a client with nightly(katello+foreman) server raises: PGError: ERROR: column hosts.mac does not exist
• BZ - 1187014 - katello-installer failed on rhel7 with error: Could not enable postgresql: Execution of '/sbin/chkconfig --add postgresql' returned 1:
• BZ - 1187206 - katello-installer should use systemd instead of chkconfig for all services on rhel7
• BZ - 1187477 - Displaced repo dropdown and search button on errata page
• BZ - 1187480 - Searching applicable errata by package_name throwing internal server error on UI and PGError in production.log
• BZ - 1187539 - Validation error needs to be updated when copying an existing activation-key with blank name
• BZ - 1187549 - UI should raise tool-tip to select CV on env selection, while editing the key which was created without env and CV
• BZ - 1187657 - Sorting on Errata id does not work on errata page
• BZ - 1187687 - WebUI -> Errata -> Content Hosts page does not load
• BZ - 1187704 - Content Dashboard - Errata overview shows duplicate errata entries
• BZ - 1187738 - hammer content-host list shows 'Available' errata instead of 'Installable' errata
• BZ - 1187750 - Activation Key content override accepts any value
• BZ - 1187760 - Email notification - Katello Sync Summary - New Errata section hyperlinks does not work
• BZ - 1187805 - Provide meaningful options for Activation key - Product Content override
• BZ - 1187820 - Synchronization of repos broken in current compose due to missing branding changes
• BZ - 1188823 - Incremental update: show resulting update task in details pane
• BZ - 1189289 - hammer repository info does not show docker-upstream-name value
• BZ - 1189892 - better feedback around composites and incremental updates
• BZ - 1189902 - Display dates in subscription management page in L10n
• BZ - 1190012 - Unable to publish content view with a docker repository product
• BZ - 1190013 - hammer --version command fails with inappropriate error
• BZ - 1190025 - Incremental Update apply button causes stacktrace
• BZ - 1190040 - Warnings (user/group tomcat doesn't exist) messages while installing 'gutterball' rpm from 6.1 compose
• BZ - 1190080 - UI creates docker registry without filling name or any other field.
• BZ - 1190088 - 500 ISE: on searching image from new container page
• BZ - 1190122 - [hammer cli] docker image info does not display tag information associated to it
• BZ - 1190224 - Incorrect error message on docker repository creation
• BZ - 1190285 - Unable to create Container from katello synced docker repos
• BZ - 1190323 - On 'Discovery_rule page, host limit should be marked as mandatory variable and validation error needs to be rephrased
• BZ - 1190622 - unable to delete lifecycle environment path in webUI: undefined method `disable_auto_reindex!' for #<Katello::KTEnvironment:0x007fbbf53328a0> (NoMethodError)
• BZ - 1190656 - Rebase Foreman Discovery to 2.0
• BZ - 1190665 - New package for Discovery 2.0: discovery_proxy_plugin
• BZ - 1190693 - publishing puppet modules places the modules in a randomly generated dir
• BZ - 1190780 - New package request for 6.1: hammer-cli-foreman-discovery
• BZ - 1191106 - [RFE] Improve user interface of interface configuration
• BZ - 1191117 - Backport SSL client verification refactoring into Satellite 6.1
• BZ - 1191214 - errata apply with inc update includes full system info and sends even without checking 'apply to content hosts'
• BZ - 1191216 - Config Group > Classes difficult to navigate and select
• BZ - 1191265 - rake failures with update bastion and angular-rails-templates
• BZ - 1191406 - [sat6.1.0 beta snap2]Getting Non-fatal POSTTRANS scriptlet failure in rpm package ruby193-rubygem-foreman-redhat_access-0.0.7-2.el6_6sat.noarch when verifying packages
• BZ - 1191422 - No success notification when adding content to content-views
• BZ - 1191504 - AVC Denials trying to publish a content view
• BZ - 1191622 - The managed checkbox on Containers index is confusing. Users wondered why they couldn't check/uncheck it.
• BZ - 1191634 - When hover over Sat 6 UI tab: Hosts, Provision Setup is in Opposite order of configuring.
• BZ - 1191666 - katello-common RPM symlinks to non-existant script
• BZ - 1191704 - Lifecycle environment delete tasks lists bad 'name'
• BZ - 1191705 - Repository delete results in failed task
• BZ - 1191723 - labels in details pages have line wrap breaking middle of words
• BZ - 1191953 - user shouldn't be allowed to create alias and bond interfaces without specifying identifer
• BZ - 1192045 - Hostgroup - need additional attributes for Katello
• BZ - 1192106 - activation keys do not attach you to repos by default (changed behaviour from 6.0 to 6.1)
• BZ - 1192113 - Command hammer --version fails (for bootdisk module)
• BZ - 1192163 - [SAM] host collections / collection actions needs de-featuring
• BZ - 1192179 - host collection list of content host members is blank
• BZ - 1192203 - We shouldn't treat users being in the wrong org as an error when they try to navigate the UI
• BZ - 1192329 - Org update doesn't show --description to update org description via hammer cli
• BZ - 1192484 - user with limited rights can see Content -> Errata menu item but it produces "403 - Permission Denied" page only
• BZ - 1192556 - Apipie-bindings 0.0.11 breaks hammer-cli-import
• BZ - 1192560 - Update foreman-discovery-image to 2.0
• BZ - 1192573 - Content View Remove fails with error 'undefined method `locations=' for nil:NilClass'
• BZ - 1192581 - hammer-cli-import broken due to API changes in Sat6.1
• BZ - 1192614 - Wrong Docker Compute resource getting provisioned
• BZ - 1192858 - Clicking on date picker button during Errata filter creation for Content View doesn't do anything
• BZ - 1192944 - A tool tip is required on add_interface form adjacent to identifier field to clearly state what identifier user should provide based on type of interface
• BZ - 1193023 - Networking configuration snippet should be used during image based provisioning
• BZ - 1193117 - content view removal does not allow removal from env and deleting archive together
• BZ - 1193118 - Content View removal does not properly update the content view list
• BZ - 1193185 - Indicate to the user that an incremental update is in progress (UI)
• BZ - 1193460 - while adding alias interface, mac should be auto populated based on attached_to interface
• BZ - 1193483 - SELinux updates are not effective due to packaging issue
• BZ - 1193547 - Getting 404 on checking gutterball status via api's
• BZ - 1193584 - Race condition causes qpid-configure command to fail
• BZ - 1193671 - 24 hour guest subscription should be hidden from user
• BZ - 1193672 - ruby193-rubygem-foreman-redhat_access-0.0.8-1 breaks Satellite 6.1.0 db:seed
• BZ - 1193684 - Composite content views don't show Docker content
• BZ - 1193701 - katello-installer fails with selinux enabled in Satellite 6.1.0 Beta Snap 3
• BZ - 1193791 - foreman-tasks fails to start on rhel7 as soon as install finished
• BZ - 1193846 - docker registry creation should require the URL
• BZ - 1193920 - Unable to create oscap policy
• BZ - 1194019 - Need to include katello-default-ca-cert for docker
• BZ - 1194173 - capsule-installer complains about missing packages: pulp-katello & python-qpid-qmf & qpid-tools
• BZ - 1194178 - oscap client packages needed in rhcommon repository
• BZ - 1194204 - Unable to register discovered host via https proxy
• BZ - 1194221 - UI should set boot-modes appropriately under subnet
• BZ - 1194331 - gutterball.conf missing gutterball.amqp.connect
• BZ - 1194343 - 500 when attempting to apply errata via content host bulk actions
• BZ - 1194396 - Contest host -> Errata tab fails with a javascript error
• BZ - 1194441 - Packages to add for both RHEL6 and RHEL7
• BZ - 1194443 - hammer content-report date params --help would benefit from syntax hint
• BZ - 1194444 - hammer content-report CSV output of dates should be in form consumable by spreadsheet
• BZ - 1194447 - Errata not showing for registered content hosts
• BZ - 1194486 - Deploy consumer RPM with Capsule instead of main server.
• BZ - 1194531 - Manifest upload: "Upstream Subscription Managment Application" has typos and bad formatting
• BZ - 1194627 - User shouldn't be allowed to create bond interface without specifying identifier when it is set to managed
• BZ - 1194641 - User shouldn't be allowed to create BMC interface without mac
• BZ - 1194664 - tool tip needs to be added on subnet page adjacent to IPAM dropdown to state all options in that
• BZ - 1194691 - All bastion_katello modal dialogs are untranslated
• BZ - 1194767 - unable to find foreman_scap_client package to list
• BZ - 1194773 - [RFE] Content hosts -> Errata tab: Add helptext to inform Applicable errata cannot be applied
• BZ - 1194784 - Content View update - needs to be dynflow'ed
• BZ - 1194997 - error while Satellite 6 installation: /Stage[main]/Candlepin::Database::Postgresql/Exec[cpdb]: Failed to call refresh: liquibase --driver=org.postgresql.Driver...
• BZ - 1195212 - Unable to edit host_grp, host, puppet-classes upon creating an oscap policy
• BZ - 1195262 - upgrade from 6.0.4 to 6.1 hangs with "Upgrade Step: migrate_pulp..."
• BZ - 1195329 - hammer import activation-key shows MissingArgumentsError: organization_id while processing activation key
• BZ - 1195602 - Provisioning does not work on subnet with static boot mode
• BZ - 1195628 - Editing interface in modal window resets compute resource NIC attributes
• BZ - 1195630 - undefined method domain_selected() when selecting Host group domain/subnet
• BZ - 1195637 - UI should report errors to the user when External AD UserGroup addition fails
• BZ - 1195690 - warning in hammer ping command
• BZ - 1195760 - Javascript error on content host errata search
• BZ - 1195972 - Content View: Cannot actually click checkbox for promoting
• BZ - 1196156 - Activation key connected to update composite content view includes non-existing repositories
• BZ - 1196283 - Missing hammer_cli_gutterball code content bits in 6.1 compose
• BZ - 1196339 - Need to remove OpenSCAP as part of the default set of installed packages
• BZ - 1196534 - unable to create user on sat upgraded from 6.0 to 6.1: "undefined method `user' for resources - []:Runcible::Wrapper (NoMethodError)"
• BZ - 1196574 - OSCAP UI banner should have the recommended location for placing openscap content on hosts end
• BZ - 1196621 - Install hammer_cli_discovery rpm automatically
• BZ - 1196715 - Need to remove the 'Default XCCDF Profile' profile from dropdown as it's a blank profile
• BZ - 1196720 - Composite Content View Component Tab display too slow
• BZ - 1196742 - Loading Activation keys list slow
• BZ - 1196758 - Containers api should be /docker/api/v2/conatiners and not /api/v2/containers
• BZ - 1196777 - Can't connect to docker compute resource (Docker::Error::AuthenticationError)
• BZ - 1196996 - Can't show host/guest association on satellite web UI
• BZ - 1197090 - foreman_scap_client config file gets configured with port 8443
• BZ - 1197477 - ERROR: update or delete on table "hosts" violates foreign key constraint "tokens_host_id_fk" on table "tokens"
• BZ - 1197764 - Red Hat Access functionality broken due to Content Security Policy configuration
• BZ - 1197806 - [RFE] Direct Client->Foreman communication shouldn't be needed for provisioning templates
• BZ - 1197836 - Content VIew json is missing the repository content counts
• BZ - 1198233 - undefined method 'marketing_product' when creating a product
• BZ - 1198238 - Incorrect bootstrap rpm link to register content host
• BZ - 1198242 - Activation Key error with hostgroup inheritance, content view, and lifecycle environment
• BZ - 1198245 - Command hammer --version fails (for discovery module)
• BZ - 1198307 - Cannot build foreman-selinux on RHEL 7.1
• BZ - 1198320 - Applying installable errata to multiple content hosts does not work
• BZ - 1198338 - Incremental update task should list the packages in an alphatetical order
• BZ - 1198363 - [RFE] As a UI user, I should see content available in an individual environment.
• BZ - 1198370 - Deleting an environment fails due to "NoMethodError"
• BZ - 1198464 - Katello needs to activate pulp consumer as node
• BZ - 1198752 - Should be installed foreman-docker 1.2.1
• BZ - 1198797 - Remote Install fails due to pulp error
• BZ - 1198815 - Incorrect UI design for selecting content hosts for errata install
• BZ - 1199078 - expired guest 24 hour subscription not removed on auto-attach
• BZ - 1199246 - unable to update openscap policy due to broken schedule feature
• BZ - 1199304 - [RFE] Need to be able to create containers from content views through the API
• BZ - 1199514 - capsule-installer throws error when --pulp=false
• BZ - 1199584 - User Confirmation window does not go away when attempting to apply errata via content host bulk actions
• BZ - 1199626 - content host name overlaps with subscription status in activation key page
• BZ - 1199674 - katello-installer --reset always fails
• BZ - 1199751 - Upgrades: cannot load such file -- uglifier (in /opt/rh/ruby193/root/usr/share/gems/gems/bastion-0.2.8/vendor/assets/javascripts/bastion/angular-i18n/angular-locale_en.js)
• BZ - 1199990 - Can't update admin flag for users via API
• BZ - 1200015 - foreman_scap_client config file does'nt get configured with policy unless policy is assigned at host level
• BZ - 1200142 - Content view republish does not make content available to content host immediately
• BZ - 1200441 - In Errata -> Content hosts tab - Check box to filter out content hosts based on Life cycle environment does not work
• BZ - 1200540 - Incremental update publishes/promotes to incorrect lifecycle environments of a composite content view
• BZ - 1200571 - Unable to perform incremental update of errata in CLI
• BZ - 1200877 - Candlepin raising "Unable to send event" error
• BZ - 1200881 - Satellite notification emails should mention which satellite generated this email
• BZ - 1201008 - Unable to perform incremental update of puppet module in CLI
• BZ - 1201011 - Foreman tasks which are stopped with failures (in warning state) should be in orange vs. blue
• BZ - 1201347 - Host create/update api docs miss owner_type
• BZ - 1201364 - Arrays in key-value parameters can't contain spaces
• BZ - 1201406 - No UI confirmation on updating filter name
• BZ - 1201410 - Content View versions page is not showing user info when empty
• BZ - 1201432 - EL7 packages trying to be applied in Errata for an EL6 host
• BZ - 1201598 - Capsule Installer: Missing dependencies in capsule repos.
• BZ - 1201606 - Can not delete product with correct permissions
• BZ - 1201735 - Katello-debug does not collect installer logs
• BZ - 1201918 - rhel6 and rhel7 erratas show the rhel6 package list in UI
• BZ - 1201924 - Gutterball fails to start with NoClassDefFoundError
• BZ - 1201934 - undefined method `docker_images' for <Katello::ContentViewVersion:0x00000013>
• BZ - 1202089 - Small typo in new strings regarding network
• BZ - 1202779 - Creating a host without OS set gives undefined method `boot_filename' exception
• BZ - 1202994 - SELinux prevents from remote SMTP delivery
• BZ - 1203424 - Removing a content host causes gofer ssl errors in /var/log/messages
• BZ - 1203851 - Only show "You don't have any ___" message if the table is not working
• BZ - 1203853 - [branding] New host form missing branding
• BZ - 1204301 - No such file or directory - "/usr/share/foreman/tmp/sockets/dynflow_socket" (Errno::ENOENT)
• BZ - 1204916 - downcase_hash_keys function missing
• BZ - 1204925 - Failure when creating a container with an image not in the host
• BZ - 1204949 - Updating client content view fails when client is registered to capsule
• BZ - 1205731 - New provisioning templates not being associated to default organization by default
• BZ - 1205826 - Docker CLI initialization error
• BZ - 1205921 - Runtime Error could not execute statement at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse:2,094 (Katello::Errors::CandlepinError)
• BZ - 1206327 - Incremental update via UI failed with an error
• BZ - 1206611 - errata listing UI page jumbled
• BZ - 1206716 - Incremental update sends empty package list to content hosts
• BZ - 1207589 - CVE-2015-1844 foreman: API not scoping resources to taxonomies
• BZ - 1208602 - CVE-2015-1816 foreman: lack of SSL certificate validation when performing LDAPS authentication
• BZ - 1216035 - CVE-2015-3155 foreman: the _session_id cookie is issued without the Secure flag
• BZ - 1232366 - CVE-2015-3235 foreman: edit_users permission allows changing of admin passwords
• BZ - 1233084 - CVE-2015-3235 - edit_users permission allows changing of admin passwords

CVEs

• CVE-2013-4346
• CVE-2013-4347
• CVE-2014-3590
• CVE-2014-3653
• CVE-2015-1816
• CVE-2015-1844
• CVE-2015-3155
• CVE-2015-3235

References

• http://www.redhat.com/security/updates/classification/#normal