Synopsis

Moderate: CFME 5.4.4 bug fixes, and enhancement update

Type/Severity

Security Advisory: Moderate

Topic

Updated cfme packages that fix a security issue, several bugs,
and add various enhancements are now available for Red Hat
CloudForms 3.2.

Red Hat Product Security has rated this update as having Moderate
Security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.

Description

Red Hat CloudForms Management Engine delivers the insight, control,
and automation needed to address the challenges of managing virtual
environments. CloudForms Management Engine is built on Ruby on Rails,
a model-view-controller (MVC) framework for web application
development. Action Pack implements the controller and the view
components.

A privilege escalation flaw was discovered in CloudForms, where in
certain situations, CloudForms could read encrypted data from the
database and then write decrypted data back into the database. If the
database was then exported or log files generated, a local attacker
might be able to gain access to sensitive information. (CVE-2015-7502)

This update also fixes several bugs. Documentation for these changes
is available in the Release Notes linked to in the References section.

All CFME users are advised to upgrade to these updated packages, which
correct these issues and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/

Affected Products

• Red Hat CloudForms 3.2 x86_64

Fixes

• BZ - 1222659 - RHOS: Fleecing an image throws following error in evm.log file
• BZ - 1265757 - Reconfigure service button gives 404
• BZ - 1268320 - VM provision dialog shows incorrect cpu count for RHEV CFME templates
• BZ - 1268905 - Internal DB Password Configuration breaks when password contains non-alphanum characters
• BZ - 1268983 - No root fileystem found when running SSA on images in OSP with Ceph
• BZ - 1269380 - WEB-UI: "Action not implemented [vm_infra/explorer]" when navigating from MySettings page to Virtual Machines page
• BZ - 1270305 - Request: "'nil' is not an ActiveModel-compatible object" error when on approve request screen
• BZ - 1272484 - UI: Missing partial error when trying to view a Request
• BZ - 1273519 - UI: Reports Menu Editor - Does not display flash message to indicate that folder name already in use
• BZ - 1273535 - Changing the default filter settings and navigating to that page displays blank screen.
• BZ - 1275782 - Cloud Provisioning dialogs do not apply RBAC filtering to resources displayed in dialog fields
• BZ - 1276353 - CFME should not use OpenStack adminURL endpoints for any services
• BZ - 1276411 - [RFE] Provide VHD Image for Microsoft SCVMM support
• BZ - 1277624 - DateTime control returns the wrong date/time if the chosen date/time is in less that 1h
• BZ - 1278062 - Wrong breadcrumb path when navigating between Provider screens using dashboard maintab
• BZ - 1280342 - UI exception when sorting Host's users
• BZ - 1281850 - Dashboards are not displayed if a user only has "view" permission on dashboards
• BZ - 1283019 - CVE-2015-7502 CloudForms: insecure password storage in PostgreSQL database
• BZ - 1285065 - 5.4.4 missing product cert for rhscl

CVEs

• CVE-2015-7502

References

• http://www.redhat.com/security/updates/classification/#normal

Red Hat CloudForms 3.2

SRPM
cfme-5.4.4.2-1.el6cf.src.rpm	SHA-256: f84ac9653843323c902212cb56490caf1f40d693285943439c91ae6c91f7a782
cfme-gemset-5.4.4.2-1.el6cf.src.rpm	SHA-256: 26f52373d07a8486e9f005d7b20d70487514c97404ef4c798c2c6b89e035b3d8
x86_64
cfme-5.4.4.2-1.el6cf.x86_64.rpm	SHA-256: 39822584a5de99675f74907356ca95ac6ef518f5b7935d367281987a1aecc6e3
cfme-appliance-5.4.4.2-1.el6cf.x86_64.rpm	SHA-256: 93ed9ae879a80e63d283014ee247f5643e2a83de77cead9cc9db9870369372a2
cfme-debuginfo-5.4.4.2-1.el6cf.x86_64.rpm	SHA-256: db4dd7ad8885c42755d4f56d8cea48929976a80c071b33e47e3cfc0ef1839620
cfme-gemset-5.4.4.2-1.el6cf.x86_64.rpm	SHA-256: 4e77ba8e9a7c686c85c5aa76f7e59e7b811f39216448717fbaa83cd3d2ec3744
cfme-lib-5.4.4.2-1.el6cf.x86_64.rpm	SHA-256: 057423e17ed2d76a5aa39dfe76ec509036009941e9f1f46359dc6f47fc822b8a