RHSA-2015:2620 - Security Advisory

Topic

Updated cfme packages that fix a security issue, several bugs,
and add various enhancements are now available for Red Hat
CloudForms 3.2.

Red Hat Product Security has rated this update as having Moderate
Security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

Red Hat CloudForms Management Engine delivers the insight, control,
and automation needed to address the challenges of managing virtual
environments. CloudForms Management Engine is built on Ruby on Rails,
a model-view-controller (MVC) framework for web application
development. Action Pack implements the controller and the view
components.

A privilege escalation flaw was discovered in CloudForms, where in
certain situations, CloudForms could read encrypted data from the
database and then write decrypted data back into the database. If the
database was then exported or log files generated, a local attacker
might be able to gain access to sensitive information. (CVE-2015-7502)

This update also fixes several bugs. Documentation for these changes
is available in the Release Notes linked to in the References section.

All CFME users are advised to upgrade to these updated packages, which
correct these issues and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/

Affected Products

• Red Hat CloudForms 3.2 x86_64

Fixes

• BZ - 1222659 - RHOS: Fleecing an image throws following error in evm.log file
• BZ - 1265757 - Reconfigure service button gives 404
• BZ - 1268320 - VM provision dialog shows incorrect cpu count for RHEV CFME templates
• BZ - 1268905 - Internal DB Password Configuration breaks when password contains non-alphanum characters
• BZ - 1268983 - No root fileystem found when running SSA on images in OSP with Ceph
• BZ - 1269380 - WEB-UI: "Action not implemented [vm_infra/explorer]" when navigating from MySettings page to Virtual Machines page
• BZ - 1270305 - Request: "'nil' is not an ActiveModel-compatible object" error when on approve request screen
• BZ - 1272484 - UI: Missing partial error when trying to view a Request
• BZ - 1273519 - UI: Reports Menu Editor - Does not display flash message to indicate that folder name already in use
• BZ - 1273535 - Changing the default filter settings and navigating to that page displays blank screen.
• BZ - 1275782 - Cloud Provisioning dialogs do not apply RBAC filtering to resources displayed in dialog fields
• BZ - 1276353 - CFME should not use OpenStack adminURL endpoints for any services
• BZ - 1276411 - [RFE] Provide VHD Image for Microsoft SCVMM support
• BZ - 1277624 - DateTime control returns the wrong date/time if the chosen date/time is in less that 1h
• BZ - 1278062 - Wrong breadcrumb path when navigating between Provider screens using dashboard maintab
• BZ - 1280342 - UI exception when sorting Host's users
• BZ - 1281850 - Dashboards are not displayed if a user only has "view" permission on dashboards
• BZ - 1283019 - CVE-2015-7502 CloudForms: insecure password storage in PostgreSQL database
• BZ - 1285065 - 5.4.4 missing product cert for rhscl

CVEs

• CVE-2015-7502

References

• http://www.redhat.com/security/updates/classification/#normal