RHSA-2017:0898 - Security Advisory

Topic

An update for cfme, cfme-appliance, and cfme-gemset is now available for CloudForms Management Engine 5.7.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.

Security Fix(es):

• A number of unused delete routes are present in CloudForms which can be accessed via GET requests instead of just POST requests. This could allow an attacker to bypass the protect_from_forgery XSRF protection causing the routes to be used. This attack would require additional cross-site scripting or similar attacks in order to execute. (CVE-2017-2653)

Additional Changes:

This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Technical Notes document linked to in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat CloudForms 4.2 x86_64

Fixes

• BZ - 1386342 - [RFE] it's impossible to Provision VMs if VMs view is opened through Providers or Clusters,etc. views
• BZ - 1393438 - Advanced search not displayed in Config mgmt
• BZ - 1395722 - [Config management] - Advanced search not functional
• BZ - 1395866 - New provider input field lengths are inconsistent
• BZ - 1396237 - Middleware - Datasource deletion - More informative message.
• BZ - 1396579 - UI: Task status icons are not aligned properly
• BZ - 1402995 - do not render service start/stop buttons (and status field?) if start and stop actions are missing
• BZ - 1411477 - Heat Template provisioning does not honor Tagging filtering
• BZ - 1414003 - RFE - Azure Orchestration Service Retirement does not delete VMs
• BZ - 1416819 - AWS Region ca-central-1 missing from Cloud Provider configuration
• BZ - 1416827 - In datastore clusters selecting storage cluster does nothing
• BZ - 1416836 - Unexpected error encountered while Viewing Full screen report
• BZ - 1416894 - Duplicate folder names between host & vm/templates causes placement issues
• BZ - 1417757 - CF fails to provider discover RHV4.0
• BZ - 1417762 - Impossible to open a condition from a condition list
• BZ - 1417763 - Snapshot link in vm summary page becomes inactive on deleting a snapshot and viewing its history
• BZ - 1417779 - Clicking on the Policy Event link doesn't take you to the event page
• BZ - 1418066 - ActionController::RoutingError (No route matches [GET] "/client/assets/images/cockpit.png")
• BZ - 1418221 - "ExtManagementSystem" string in Provider policies
• BZ - 1418815 - Wrong provider condition title in the tree
• BZ - 1419603 - Getting undefined method with_interval_and_time_range errors in evm.log
• BZ - 1419694 - Catalog Item Long Descriptions allow the user to override UI styling
• BZ - 1420284 - [CFME] db:migrate warning 'supports_feature_mixin.rb:103: warning: key :terminate is duplicated and overwritten on line 111'
• BZ - 1420442 - Unable to provision VMs to a VLAN with a '/' in the name
• BZ - 1420467 - Containers Topology - second search not working
• BZ - 1421154 - check_provisioned Check orchestration deployed doesn't properly handle rollback_complete
• BZ - 1421158 - control policy events aren't generated for azure instances
• BZ - 1421161 - network manager timelines 404 found
• BZ - 1422647 - Customer concered about memory and elapsed time to generate custom report in global reporting region
• BZ - 1422648 - Impossible to access Cockpit administration tool from Self-Service UI
• BZ - 1422649 - Appliance fails to terminate (ie, kill) worker processes that fail to respond to requested termination.
• BZ - 1422650 - Services with nil service_template will fail while looking up atomic? or composite?
• BZ - 1422651 - UI: Service catalog ordering - spinner disappearing too soon, not in sync with page load
• BZ - 1422652 - Inconsistent alt-text for advanced search buttons
• BZ - 1422653 - Update set_security_group method to accept an array of MIQ objects
• BZ - 1422654 - Node lifecycle: ability to set node manageable from provisioning state enroll
• BZ - 1422975 - Missing links to nested Resource Pools in Resource Pool summary screen
• BZ - 1423032 - Stack template page needs to change the font color
• BZ - 1423470 - Running any rake task gives a warning message before runnning
• BZ - 1424255 - SPICE connections to RHV fill up log with error message
• BZ - 1425492 - Chargeback for Container Images - Default Container Image Rate is editable
• BZ - 1425494 - cannot remove user belonging to group EvmGroup-super_administrator via tree
• BZ - 1425873 - MiqUiWorker fails to start
• BZ - 1426433 - Cannot generate VM base report
• BZ - 1426628 - [Regression]C&U graphs don't get grouped by tags
• BZ - 1426638 - Security groups reflected twice on Cloud tenant page
• BZ - 1426683 - Unable to compute performance rollups for OpenShift
• BZ - 1427168 - unable to bring VM out of retirement from details page
• BZ - 1427169 - Provide CFME/RHV build in qcow format, further to image uploader tool drop for RHV-4.1
• BZ - 1427172 - trying to log in with user admin after timeout on different user will get the UI stuck on login + error on wrong credentials will show in log
• BZ - 1427298 - vCenter DVS network selection after upgrade to CloudForms 4.2 fails
• BZ - 1427299 - Missing form buttons on Catalog Items - Add new Button Group and Buttons
• BZ - 1427321 - "My Company Tags" not loading after login for creating new group
• BZ - 1427520 - User access filtering using tags for clouds networks and floating ip| isnt' working as expected.
• BZ - 1427522 - Cancel edit cloud subnet throw undefined method `empty?' for nil:NilClass
• BZ - 1428079 - Can not display instances on one tenant within OSP in CloudForms
• BZ - 1428122 - Creating or copying a report drops browser session and returns to sign in screen
• BZ - 1428124 - RuntimeError Multiple parents found / in generate_one_content_for_group
• BZ - 1428130 - [RFE] OpenShift Projects report Pods: Deleted On attribute empty
• BZ - 1428131 - limit list of user's roles to for creating a group
• BZ - 1428508 - When invoking a start or stop action on a instance via API, it does not reflected in CloudForms 4 UI however it performed desired action on cloud side.
• BZ - 1428509 - Missing "Reset" option for SCVMM VM from Details
• BZ - 1428512 - all volumes in systems are shown under a pod summary
• BZ - 1428579 - Cannot approve an automation request in a 'Pending Approval' state
• BZ - 1428895 - When filtering datastores the title is "the datastore datastores" which makes no sense
• BZ - 1428897 - Custom Attributes in WebUI Change Order as Created / Updated - Not sorted
• BZ - 1428899 - Copy Chargeback report will not add unless a parameter is changed first
• BZ - 1428900 - [RFE] Container Chargeback - get rate assignment from enterprise
• BZ - 1428903 - disable local login does not work when cfme external auth is configured for IPA
• BZ - 1428904 - Middleware Topology - broken icon for Servers
• BZ - 1429648 - An exception in a worker's sync_workers can cause the server process to exit with fatal error
• BZ - 1429650 - External authentication works when logging into the Admin UI but doesn't work for the same user to get into the Service UI
• BZ - 1429652 - The email validation is no longer accepting upper case characters in the users email address.
• BZ - 1429999 - CHRONYD getting stopped/failed in CFME-4.2 Appliances after 5-10 minutes
• BZ - 1430088 - Network I/O Metrics empty in RHEV
• BZ - 1430089 - Service view VM buttons all click through to first VM
• BZ - 1430439 - Ordering of Saved Chargeback reports needs to be reversed
• BZ - 1430542 - [RFE] Service Dialog drop-down field should support multi-select option
• BZ - 1430835 - CSRF tokens are erroneously being checked for external authentication
• BZ - 1430838 - Services > Catalog Items - services in the tree don't match right side
• BZ - 1430937 - Service Dialog does not save default value <None> for drop down or radio button
• BZ - 1431154 - No flash message after addition of a new policy is cancelled
• BZ - 1431162 - Service Dialog - Element visibility on condition is not working in Self-Service portal
• BZ - 1431163 - [SDN] - Security groups/Floating IPs not displayed in Network Topology View
• BZ - 1431164 - The cleanup process is never started because of bugs in the code
• BZ - 1431165 - "FATAL -- : ActionController::RoutingError (No route matches [POST] "/vm_infra/console/198")" found in production.log file while accessing vm console with MKS plugin
• BZ - 1431166 - Wrong selection of parent for VM in a tree
• BZ - 1431168 - Dashbord and Report information not filtered by Tenancy
• BZ - 1431620 - [Scale][RHV] Inventory refresh fail on timeout, after ~2 minutes.
• BZ - 1431641 - Issue when Azure VM doesn't include offer in.
• BZ - 1431727 - UI: Add new Subnet must be disabled when there is no cloud provider present.
• BZ - 1431808 - RHEV VM Reconfigure: Hot unplug CPU and Hot add memory request succeed, though it should fail on not-supported
• BZ - 1431842 - Service requests show none with "refresh" buttons instead of selected values
• BZ - 1432093 - Removing all folders from an accordion in Report Menu makes the Reports page display error
• BZ - 1432098 - Chargeback by Image cannot assign Rate for Label with special characters
• BZ - 1432174 - CVE-2017-2653 CloudForms: UI security issue on Openstack actions
• BZ - 1432463 - Web UI inaccessible after changing number of UI Workers
• BZ - 1432467 - [Azure] ManageIQ string in downloaded PDF
• BZ - 1432639 - RBAC Search Errors out on Strings
• BZ - 1432957 - AWS flavor list is out of date.
• BZ - 1432960 - Missing AWS Regions
• BZ - 1432961 - Unable to hot add new thin provisioned disk to VM
• BZ - 1432962 - Host Storage Device retrieves more information than necessary
• BZ - 1433069 - [Multi-tenancy, LDAP] - Images not visible to tenant / Instances not visible to tenant after provisioning
• BZ - 1433089 - Error after expanding Button Group in Catalog Items
• BZ - 1433093 - Mixed up values in Low and High operating ranges for C&U graphs
• BZ - 1433094 - Refresh of OSP10 OpenStack/Director undercloud failing
• BZ - 1433366 - Editing an already created schedule for "Container Image compliance" doesn't populate all the existing schedule settings
• BZ - 1433435 - Policy to exclude a VM from analysis shows as false but scanning is still happening
• BZ - 1433486 - Corrected loading record id by selected node
• BZ - 1433500 - Duplicate ContainerImage records with same digest
• BZ - 1433962 - Control Explorer is displayed despite role has restricted access to it
• BZ - 1433974 - Persistent Volumes list grow exponentially upon refresh.
• BZ - 1433976 - List items on Policy profiles page are not clickable
• BZ - 1433979 - Reports fail when selecting a Custom Attribute containing one or more dots
• BZ - 1433980 - VM extend retirement fails
• BZ - 1433981 - Charge back reports are not showing the data
• BZ - 1434012 - Clipped Chart Controls on Dashboard
• BZ - 1434096 - All Endpoints' [Validate] buttons disabled/enabled according to main endpoint fields
• BZ - 1434150 - [Scale] MiqWidget.generate_content at large scale consumes tremendous amount of memory and times - out
• BZ - 1434151 - Services: My Services tree does not show services that are marked as display false.
• BZ - 1434157 - Automate Simulation: The simulation form behaves weird after certain steps
• BZ - 1434158 - Stack trace when running fix_auth
• BZ - 1434160 - Impossible to distinguish Labels and entity attributes in OpenShift Chargeback Reports
• BZ - 1434172 - Azure Cloud provider fail to refresh
• BZ - 1434411 - Undefined Method Error virtual_custom_attribute_name for Chargeback Report OpenShift
• BZ - 1434428 - No payload sent to rhevm4.0 from cfme-5.7.0
• BZ - 1434549 - [RFE] Routers do not allow you to set/clear external network gateway
• BZ - 1435278 - Metrics collections consistently fail when where last collection date/time is weeks to months prior
• BZ - 1436223 - Unable to order service
• BZ - 1436340 - [RFE] Replace Ceilometer event with Panko
• BZ - 1436854 - miq worker in aborted status
• BZ - 1437560 - [RHOS] - changing ownership of image returns error
• BZ - 1438450 - Unable to open Details(Summary) of archived Instance
• BZ - 1438888 - [RFE]: Containers should be added to Service Model
• BZ - 1439308 - Excessive log lines for "Initializing DRb Connection to MiqServer with ID"
• BZ - 1440405 - subselection in access control role, not bubble up in tree display
• BZ - 1440408 - excon gem defaults generate error connecting to OSP

CVEs

• CVE-2017-2653

References

• https://access.redhat.com/security/updates/classification/#moderate