RHSA-2017:0320 - Security Advisory

Topic

Updated cfme packages that fix bugs and add various enhancements
are now available for Red Hat CloudForms 4.2.

Description

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view controller (MVC) framework for web application development. Action Pack implements the controller and the view components.

This update fixes various bugs and adds several enhancements. Documentation for these changes is available in the Release Notes linked to in the References section.

Security Fix(es):

• A logic error in valid_role() in CloudForms role validation could allow a

tenant administrator to create groups with a higher privilege level than
the tenant administrator should have. This would allow an attacker with
tenant administration access to elevate privileges. (CVE-2017-2632)

This issue was discovered by Matouš Mojžíš (Red Hat).

All CFME users are advised to upgrade to these updated packages, which correct these issues and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat CloudForms 4.2 x86_64

Fixes

• BZ - 1382768 - My Filters in datastores are not shown
• BZ - 1390729 - [Azure] - No LB icon/button in Network topology
• BZ - 1390731 - clicking on Unassigned Profiles Group from satellite provider
• BZ - 1391748 - [ja_JP] Translations are missing in 'Compute'-'Infrastructure' menu and its sub menu pages
• BZ - 1391750 - [ja_JP] Translation issues observed on cloud intelligence->Reports->reports page.
• BZ - 1391757 - [ALL LANG] Not fully localized on Clouds -> Providers page.
• BZ - 1394331 - Compare,Drift views missing in VM and drift comparison pages
• BZ - 1394339 - Missing "Items per Page" in Paginator with 5:4 or 4:3 screen ratio resolution
• BZ - 1394341 - Updating the default GTL view settings does not work for cloud key pair page
• BZ - 1394844 - Unexpected error when clicked on edit cloud provider after deleting cloud provider
• BZ - 1395304 - [RFE] Containers should have "My filters" and advanced search same way as other providers
• BZ - 1395839 - UX: Hovered redhat insights menu item text interferes to its arrow
• BZ - 1395840 - Service dialog editor drop down list Refresh problem
• BZ - 1395857 - OCP nodes showing as "not ready" in topology view but as "Ready" in Container Node view
• BZ - 1395898 - UI: 'Lifecycle' button is still alive, when no providers
• BZ - 1396222 - Middleware - Missing Alt on Add Datasource form buttons
• BZ - 1396238 - Middleware Provider - Timelines: JS Error and endless load
• BZ - 1396239 - Middleware - Support of MariaDB Datasource type
• BZ - 1396240 - Orchestration template : Unable to add Vapp Template
• BZ - 1396241 - [beta1] vm console icon not rendering correctly
• BZ - 1396243 - Spinning UI activity overlay stuck/infinite when using advanced search
• BZ - 1396575 - [ALL LANG] Middleware - Servers - Datasource - C&U screen has untranslated entries
• BZ - 1396576 - Some of the Power Operation strings are not getting extracted in the i18n gettext catalog for SUI
• BZ - 1396577 - when I scroll tables in provisioning dialog, table header is scrolled along with table contents
• BZ - 1396580 - Vmware Storage Profile is not shown in Provisioning Request
• BZ - 1397151 - [RFE] Unknown operating system for AWS instances
• BZ - 1397154 - tooltips for group of events in timelines don't look good
• BZ - 1397157 - date picker control appears under navigation bar in timelines view
• BZ - 1397158 - sometimes event text appears partially beyond the tooltip's bounds
• BZ - 1397159 - timelines control displaying current cursor position on timescale is annoying and unusable
• BZ - 1397248 - pods are named 'container groups' in the policy explorer right cell
• BZ - 1397416 - UI: Hover text is required for Help "(?)"
• BZ - 1397509 - many vm create/remove/stop/start Azure events are absent in timelines though present in DB
• BZ - 1397532 - [ja_JP] Need to change the strings on storage manager ->Monitoring -> Timelines -> Options for "Management Events" and "Policy Events"
• BZ - 1397874 - [ALL LANG] Compute-Container-Container nodes has untranslated entries
• BZ - 1399207 - vm.create_snapshot fails for rhev vm with undefined method `create_snapshot'
• BZ - 1399208 - [Multi-tenancy] - RFE - Disable renaming of Tenants created by tenant mapping
• BZ - 1399209 - Text does not appear when hovering over VMs & instances
• BZ - 1399211 - Infrastructure Topology legend buttons inaccuracy
• BZ - 1399214 - Cloud provider list view has bad region value
• BZ - 1399216 - giving access to view the quota of a tenant but not listing still allows a user to list all tenants
• BZ - 1399221 - [RFE] NFS41 storage type not supported for SmartState Analysis
• BZ - 1399669 - "Starting Date" in scheduled report is always next day; cannot be set to another day
• BZ - 1399677 - [RFE] Add settings key to disable console proxy
• BZ - 1399679 - [RFE] Launch an URL returned by an automate button
• BZ - 1400202 - [ALL LANG] Compute - Clouds - Instances - Instances by Provider has missing translations
• BZ - 1400204 - Filter out events from Azure Classic providers
• BZ - 1400212 - [Beta 1] lack of consistency in Custom Logo UI.. Check box and Yes/No Slide
• BZ - 1400303 - SSUI: My Request submenu needs translation when language is selected
• BZ - 1400616 - Power ops showing as available for an Archived vm.
• BZ - 1400704 - Documentation via SSUI opens up in the same SSUI window instead of a new tab/window
• BZ - 1401017 - Cloud Intel->Timelines->Events->Policy timelines(reports) have a really inobvious names
• BZ - 1401018 - VM reconfigure: submit is disabled, when memory new value is set after add disk
• BZ - 1401030 - [Amazon EC2][SDN] - Network provider not refreshed weirdness with tenancy
• BZ - 1401044 - Back, reload and configuration toolbar buttons are misplaced on Pxe page
• BZ - 1401103 - Unable to set retirement date for Stacks
• BZ - 1401935 - Heartbeat failure for workers is not reported as ERROR log line but INFO log line
• BZ - 1401956 - Sort providers table crash
• BZ - 1401957 - Unable to perform any actions on cloud objects from list view when navigated to cloud tenants
• BZ - 1402118 - appliance_console is unable to set time-zone for america/argentina "Failed to apply timezone configuration"
• BZ - 1402138 - [RFE] Default database name when setting up global replication subscriptions
• BZ - 1402139 - Automate Customization: When editing automate button, it doesn't remember previously saved button image and display field values.
• BZ - 1402162 - Subnet form needs to allow ipv4/ipv6 selection during create, and lock ipv4/ipv6 and CIRD during edit
• BZ - 1402524 - UI: Configuration -> Access Control - On User/Group/Role summary screens text is no longer a link
• BZ - 1402526 - Alert profiles assignments have container providers under cloud/infrastructure providers
• BZ - 1402527 - [Networks Topology] - LB Tags not shown in Topology
• BZ - 1402528 - Azure : Instance name restriction should be shown in UI when creating a catalog item for Azure
• BZ - 1402529 - No option to see next page in "services-->requests"
• BZ - 1403011 - C&U Configuration Screen does not display anything
• BZ - 1403019 - Azure instance disks not deleted
• BZ - 1403981 - Create snapshot has memory checkbox, even though VM is Down.
• BZ - 1403983 - After performing an upgrade, no role workers start on new appliances
• BZ - 1404316 - RHEV VM Reconfigure: Hot plug CPU & memory together, pass on CFME, though memory hot plug fail on 256 multiply
• BZ - 1404365 - Order Service drop-down for "App Name" no longer allows for search filter
• BZ - 1404427 - "audit log" is logged with "new_value" instead of actual data when new user is created.
• BZ - 1404431 - provisioning instance fail: FATAL -- : Error caught: [NoMethodError] undefined method `[]' for nil:NilClass
• BZ - 1404447 - Empty lists in Chrome
• BZ - 1404454 - VMware Auto Placement issue with insufficient space on Datastore
• BZ - 1404526 - Folder relationship change causing a re-classify of all children VMs
• BZ - 1404669 - Tenant cannot import datastore without datastore being locked
• BZ - 1404746 - Retirement state machine does not handle Ansible Tower services when part of a bundle
• BZ - 1404825 - Unable to trigger a smartstate scan from the clouds Instances view unlike infra vm view
• BZ - 1404827 - [RFE] CloudForms 4.1 unable to add Azure Gov Cloud Provider
• BZ - 1405193 - Unable to specify disk size in IE11 when adding additional disk
• BZ - 1405197 - When exporting reports into PDF only half of the data is displayed
• BZ - 1405200 - Can't create an alert
• BZ - 1405201 - VMs & Templates links point to Host & Clusters in the relationship accordion
• BZ - 1405640 - Subnet CRUD actions do not use task queue
• BZ - 1405641 - Network CRUD actions do not use task queue
• BZ - 1406160 - Floating IP/Security Group actions missing corresponding events
• BZ - 1406161 - Floating IP/Security Group Create Task Queues have reversed method names
• BZ - 1406163 - Unable to delete the subnets for azure,ec2 and gce providers
• BZ - 1406167 - Timelines not displayed on the Configuration->Diagnostics page
• BZ - 1406434 - Default validation for data type is not properly set when adding a new TextBox field
• BZ - 1406798 - event info tooltip appears only for first clicked event in timelines
• BZ - 1408278 - Add Access button group to Cloud Instance and move the HTML5 icon to it
• BZ - 1410516 - Impossible to login in SSUI due to ERROR on SSUI Dashboard
• BZ - 1410535 - Chargeback per time is limited to hourly
• BZ - 1410587 - [ALL LANG] Services - Workloads - Provision has untranslated tab names and labels
• BZ - 1410588 - Floating IP CRUD UI Missing
• BZ - 1410791 - "Selected Day Percent Utilization" graph is absent
• BZ - 1410817 - Remove 'execute method' checkbox from Automation Schedule UI
• BZ - 1410818 - Filter out all the host controllers (except the domain ctrl) when 'counting' how many domains there are
• BZ - 1410819 - Fixed associations for network_port and openstack network_port service models
• BZ - 1410828 - [RFE] Find Azure orchestration stack failure from its operations
• BZ - 1410831 - Wrong label in c3 chart click menu
• BZ - 1410844 - [RFE] Include log output in automation.log
• BZ - 1410845 - Can't remove retirement date
• BZ - 1410846 - We might not be purging all tables that we should be
• BZ - 1410851 - Expose custom_attribute methods to ext_management_system service model
• BZ - 1410927 - Retire Service screens returns to Request page rather than staying on the My Services page
• BZ - 1411350 - Middleware provider reports the incorrect name of the domain
• BZ - 1411351 - Make container node web console button match vm's
• BZ - 1411353 - some of timelines controls have wrong text style
• BZ - 1411357 - Setting relationship data for generic objects in automate does not work
• BZ - 1411358 - UI : Pinning the service menu shows "Red Hat Insights" menu
• BZ - 1411359 - launch_ansible_job doesn't support multiple Ansible Tower providers in CloudForms
• BZ - 1411362 - URLs might not be generated properly due to string conversion issue
• BZ - 1411364 - [RFE] Support container/infra/cloud provider policies in the UI
• BZ - 1411368 - Tag Visibility - Container builds should honor tag visibility
• BZ - 1411369 - [RFE] CAPABILITY_IAM error after IAM role assignment with amazon cloudFormation template
• BZ - 1411370 - Unexpected Error when attempting to run Compliance of Last Known Configuration
• BZ - 1411372 - [Ansible Tower] - Search bar missing when navigated to Config manager e.g. from Compute
• BZ - 1411373 - Service : Click on stack from service Page shows "Invalid Input"
• BZ - 1411433 - Cloud Instances List View Table missing cells/improper rendering
• BZ - 1411459 - Display parent tenant only when it is allowed by RBAC
• BZ - 1411461 - TimeLine accordion broken on Storage Managers summary page
• BZ - 1411463 - [Beta 1] OpenStack Cloud Topology View: Icons are different in the selection and the main body for Availability Zones:
• BZ - 1411466 - Allow adding custom attributes with sections
• BZ - 1411471 - [Beta 1] When graph is close to border, menu is not visible
• BZ - 1411473 - Expose miq_groups to Automate
• BZ - 1411478 - Metrics Collector Workers memory threshold displayed as 200MiB in the Web UI, however they exit at 500MiB threshold
• BZ - 1411507 - [RFE] better traceback for Ansible Tower API errors
• BZ - 1411509 - Can't save retirement date without notification
• BZ - 1411511 - Notifications - subject may not have tenant.
• BZ - 1411514 - "Show detailed events" checkbox of Timelines view removes main events from the timelines
• BZ - 1411516 - [negative] Deleting subnet connected to instance raise 'Unexpected error encountered '
• BZ - 1411517 - can't add cloud provider with the same name again
• BZ - 1411518 - Service catalog Item entry point dialog text is overcomplicated
• BZ - 1411519 - [RFE] Security Groups missing CRUD UI
• BZ - 1411791 - VM details cluster field vanish, after update VM to another cluster.
• BZ - 1411793 - Typo on Middleware JMS Topic chart(Messages) and legends are in mix of plural or singular form
• BZ - 1411797 - Throws an Unexpected error while comparing clusters
• BZ - 1411878 - appliance_console crash when running Logfile Configuration without setting up database first
• BZ - 1411880 - VM's owner can't access VMs if "Username" field contains uppercase letters
• BZ - 1411881 - policy events appear w/o information which entity those belong to in Timelines
• BZ - 1411882 - undefined method `[]' for nil:NilClass [dashboard/tl_generate] while accessing Cloud Intelligence->Timelines page
• BZ - 1411885 - Incorrect zoom out icon on C&U graphs
• BZ - 1411941 - [RFE] Chargebacks for SCVMM
• BZ - 1411973 - In the tree view subcategories should not be opened, because there is so big list then
• BZ - 1411975 - Missing flash message after Middleware "Add Datasource" operation and wizard not reset
• BZ - 1411982 - UI: Add new Cloud Volume must be disabled when there is no cloud provider present.
• BZ - 1412206 - Selecting a Group Causes UI to Spin Indefinitely
• BZ - 1412221 - Discrepancy in costs reported between daily and monthly Chargeback reports
• BZ - 1412279 - Database replication is failing for LVDC
• BZ - 1412280 - Manipulation of custom_custom attributes on provider class Provider fails
• BZ - 1412283 - Chargeback rates should also be available for "daily"
• BZ - 1412284 - VM console button superfluously warns it may fail
• BZ - 1412285 - $websocket_log level is not configurable
• BZ - 1412286 - 'Show Full screen report' option missing in Configuration button on Saved Reports page
• BZ - 1412287 - Relax email validation constraints
• BZ - 1412288 - Generate notification for VM Provisioning error in automate
• BZ - 1412289 - Generate notification for Service Provisioning error in automate
• BZ - 1412290 - Attach/detach for Cloud Volume fails with "unknown method get_checked_volume_id" error
• BZ - 1412291 - Namespace: Name uniqueness validation is not case-insensitive, like other Automate objects.
• BZ - 1412293 - SSUI: Hand pointer on service icon
• BZ - 1412312 - Refresh failed when adding an OSE provider
• BZ - 1412314 - Filters are sometimes saved with different name
• BZ - 1412315 - When saving filter sometimes errs Name has been taken even when there was no filter with same name
• BZ - 1412316 - Saving filter errs Search Name is required even when value is filled in
• BZ - 1412383 - [RFE] Add performance based reports for OSE/OCP providers
• BZ - 1412396 - Host Summary for VMs report failing
• BZ - 1412682 - Issue with fog-openstack 'update_quota.rb'
• BZ - 1412738 - Use proper name of column in tooltip in charts
• BZ - 1412740 - Add validation message for chart with values
• BZ - 1412825 - [RFE] google provider connection using http_proxy configured in CloudForms
• BZ - 1413086 - Incorrect tooltip message displayed on region diagnostics configuration button
• BZ - 1413103 - Service dialogs items(tabs/boxes/elements) can be saved even when it doesn't fulfill requirements
• BZ - 1413113 - Error in my settings after timeout
• BZ - 1413119 - Removing actions from VM Compliance Check event removes the event from the compliance policy
• BZ - 1413123 - Tenant admin can create a super admin
• BZ - 1413154 - Clarify the "dedicated database instance" prompt in the console
• BZ - 1413167 - Wrong zone set for appliances in global region
• BZ - 1413205 - In Dashboard view for infrastructure, Recent hosts and Recent VMs are not filtered by provider
• BZ - 1413207 - Error in changing the RSA Key of an OpenStack Director provider
• BZ - 1413210 - SSH RSA key validation fails with error for OpenStack Infra Provider
• BZ - 1413212 - [RFE] Routers do not allow you to add/remove interfaces
• BZ - 1413621 - Check compliance of last known configuration crash
• BZ - 1413677 - Network Router provisioning must call and use raw create method
• BZ - 1413695 - [beta1] Openstack attach volume should only list available volumes in the drop down
• BZ - 1413769 - The counter ae_state_retries is not incremented if $evm.root['ae_result'] = 'retry' is set in a state machine on_exit method
• BZ - 1414012 - Provider under catalog item visible for a user who don't to have a permission for viewing a provider
• BZ - 1414013 - [RFE] - Expose mechanism in AUTOMATE allowing coder to indicate that the automate retry should be targeted to the same machine initiating the retry
• BZ - 1414014 - A tag control element in a dialog called from a button is not passed to the button method
• BZ - 1414015 - "abandon changes" dialog appears on attempt to open another location via menu from timelines page
• BZ - 1414550 - "Delete" was removed from Power Action in VM Details Menu
• BZ - 1414583 - SSUI lets you save a retirement date from the past
• BZ - 1414848 - The chargeback report gives wrong information
• BZ - 1414870 - Created filters in Virtual Machines are not displayed in the tree until the page is refreshed
• BZ - 1414872 - Adding filter in Datastore Clusters results in missing tree view
• BZ - 1414876 - Created filters in datastores are not displayed until the page is refreshed
• BZ - 1414882 - podfying cfme: please add "less" command to initial application deployment
• BZ - 1414884 - net-tools RPM not available on CFME containers (podified or monolithic)
• BZ - 1414885 - OpenStack VM Console returns with an argument error
• BZ - 1414886 - Central Admin - Impossible to distinguish Customize Templates
• BZ - 1414887 - Suspending role in diagnostics Error caught: [ActiveRecord::RecordNotFound] Couldn't find MiqServer with 'id'=0
• BZ - 1414888 - No flash message when importing custom report
• BZ - 1414889 - Broken string in Title
• BZ - 1414891 - Containers SmartState analysis not working for images from unknown image registry,
• BZ - 1415217 - Tenant admin can create groups for other tenants
• BZ - 1415247 - Target refresh of VM does not update host
• BZ - 1415248 - Missing memory unit on Cluster Utilization graphs on provider dashboard view
• BZ - 1415332 - A critical section read of the worker's heartbeat information was not protected with a mutex
• BZ - 1415333 - Ec2 events are not associated to vms
• BZ - 1415754 - SSUI: Unable to save a blank retirement date to remove previously saved retirement date
• BZ - 1415755 - podfying cfme: clean-up evm.log in the cfme pod
• BZ - 1415756 - [Azure LB] - broken table in List view
• BZ - 1416001 - [FloatDomainError]: Infinity Method in Chargebacks for SCVMM
• BZ - 1416077 - Live migration to different cluster doesn't work for RHV
• BZ - 1416093 - Same value gets repeated multiple times on Y-axis of C&U graphs
• BZ - 1416821 - VHD image for AWS mounts database drive as /mnt
• BZ - 1416826 - VMware EMS Refresh fails with "block (2 levels) in getMoPropMulti' error
• BZ - 1417197 - New fields (e.g. tags, custom attributes) do not appear in Report Editor
• BZ - 1417974 - refresh of OCP 3.2 crashes with permission error in recovery
• BZ - 1418400 - Impossible to assign an alert profile
• BZ - 1418749 - authentication_key exposure missing from EMS service model in 4.2GA
• BZ - 1418846 - Discrepancy in resource usage reported between daily, weekly, monthly Chargeback reports
• BZ - 1419186 - [Regression]Error generating Chargeback reports
• BZ - 1419680 - Container Provider: Image Registries are not collected from Images originating from Openshift
• BZ - 1419738 - SSUI: Clicking on the 'Total Requests' link on SSUI Dashboard doesn't take you to the Requests page
• BZ - 1420555 - Service dialog dropdown differs from what is processed by service request
• BZ - 1420888 - [RHV] VM provision->Environment-> host list decreases, after 1 or more Vm provision
• BZ - 1420916 - Refresh of infrastructure provider fails with bad request with OSP director as provider
• BZ - 1420917 - Refresh of OSP10 OpenStack/Director undercloud failing
• BZ - 1422178 - Adding disk to a VM in RHV provider, via VM reconfigure, does not activate it
• BZ - 1422241 - Utilization data for OSP cloud instances does not show up
• BZ - 1423031 - VMware : Failure in snapshot revert
• BZ - 1423033 - Timeline's minus button is corrupted in IE11
• BZ - 1424260 - BootstrapTreeview loses the focus after creating or deleting Container Policies
• BZ - 1424275 - UI: "Check Box" label is not aligned properly.
• BZ - 1424977 - CVE-2017-2632 cfme: tenant administrator can create a group with higher permissions

CVEs

• CVE-2013-4492
• CVE-2017-2632

References

• https://access.redhat.com/security/updates/classification/#moderate