Synopsis

Low: CloudForms 4.7.7 security, bug fix and enhancement update

Type/Severity

Security Advisory: Low

Topic

An update is now available for CloudForms Management Engine 5.10.

Red Hat Product Security has rated this update as having a security impact of Low. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.

Security Fix(es):

• bubblewrap: temporary directory misuse as mount point (CVE-2019-12439)
  

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

This update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

If the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.

Affected Products

• Red Hat CloudForms 4.7 x86_64

Fixes

• BZ - 1695963 - CVE-2019-12439 bubblewrap: temporary directory misuse as mount point
• BZ - 1702497 - Datepicker Field Cannot be Set to Required
• BZ - 1721118 - [Regression][V2V] "Maximum concurrent migrations per conversion host" in UI not working
• BZ - 1724715 - VM reconfiguration (OSP provider) from Global Region is not working
• BZ - 1725894 - Can not modify the service dialog, gives DialogFieldAssociationCircularReferenceError
• BZ - 1725960 - [v2v] While VMs are migrated tens of ssh-agent errors appear in evm.log
• BZ - 1726388 - Datepicker field allows to enter alphanumeric text, no validation against the text
• BZ - 1726394 - [v2v] Add more throttling logging, to identify why specific conversion host is picked
• BZ - 1726438 - Validating the format in service order page even after disabling the validation button in service dialog
• BZ - 1726667 - Cloudforms doesn't capture event from Openstack Ceilometer
• BZ - 1727970 - Service reconfigure failed with error "Service Reconfigure failed"
• BZ - 1727989 - Service Dialog values doesn't load on init also on manually refresh as well
• BZ - 1727990 - Validate field in CloudForms Service Dialogs
• BZ - 1728033 - Sorting tables doesn't work in service request page

CVEs

• CVE-2019-12439

References

• https://access.redhat.com/security/updates/classification/#low
• https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes

Red Hat CloudForms 4.7

SRPM
ansible-runner-1.3.4-2.el7ar.src.rpm	SHA-256: 4ec0a785186894f9013713eba79eae014c0b0b51645ea9c07f8fd0aaeeca9976
bubblewrap-0.3.3-2.el7at.src.rpm	SHA-256: 231323088385dff309e05834d2434f6d2a52376397e3fcd19cbfd29336ba8840
cfme-5.10.7.1-1.el7cf.src.rpm	SHA-256: 17168bc335ae9f97fe3d1211bb5bd263ec480bd8ca9f652f0f99a3801339fb4e
cfme-amazon-smartstate-5.10.7.1-1.el7cf.src.rpm	SHA-256: 7665315a1e2c9ce38f342c5b88300f7e91709909d9a47311655646b286616040
cfme-appliance-5.10.7.1-1.el7cf.src.rpm	SHA-256: be0f424475d9fb7ed23b7da703665e4ff952d44f0aec58ee7a7cda6a9b8934b8
cfme-gemset-5.10.7.1-1.el7cf.src.rpm	SHA-256: 4a75371decdba725fd23697dd1794fdb1252bcec3c643728bdfd48822380a041
ovirt-ansible-hosted-engine-setup-1.0.20-1.el7ev.src.rpm	SHA-256: e83cac1380206158dfa33892bd47317e34de5ba9827fddecbd006d7a6030626e
ovirt-ansible-image-template-1.1.11-1.el7ev.src.rpm	SHA-256: 7c63f13d1897df6c4ee6880e8820d266392cced9b1d28632509aaa801b9bd384
ovirt-ansible-manageiq-1.1.14-1.el7ev.src.rpm	SHA-256: 85cedfb6be6e97f80d6370aae76094072d7eb987ac25a6f7dfea77b37b7d782c
ovirt-ansible-vm-infra-1.1.18-1.el7ev.src.rpm	SHA-256: 2ba04c9fca86662c1d5c944446f121f15316995f7e90704fdab94698bc49bb67
x86_64
ansible-runner-1.3.4-2.el7ar.noarch.rpm	SHA-256: 17cda79b8277d6ea0f7a9e09ad0c50ce2e7432d1dd987e4b964477a1346ad4a0
ansible-tower-3.5.0-1.el7at.x86_64.rpm	SHA-256: ce64208e13ce4e08acfc03126dce44785a830f31516591c81b76e372e8f683b0
ansible-tower-server-3.5.0-1.el7at.x86_64.rpm	SHA-256: d9c9ee11e3d0ebf9f3e42cdcc206c11f8fc1f409e7db3513999fedb1ad36e342
ansible-tower-setup-3.5.0-1.el7at.x86_64.rpm	SHA-256: 84efc3f1c391f995c20b003c998cf985bd681dfc8363835a0667848a7748a29a
ansible-tower-ui-3.5.0-1.el7at.x86_64.rpm	SHA-256: 959fd9adb8477f36e561344d381d68a74d75419acc58ee633cb822462f95de52
ansible-tower-venv-ansible-3.5.0-1.el7at.x86_64.rpm	SHA-256: 2bab49c8da40298760f40bcd5c09b05bcb64cf7ec047cb0812b1858ea9169e1c
ansible-tower-venv-tower-3.5.0-1.el7at.x86_64.rpm	SHA-256: 9f33601fb800fa95bff1a4d8b1e57a072c19457ba90566f7551f7243df30217e
bubblewrap-0.3.3-2.el7at.x86_64.rpm	SHA-256: f5ed3a38aff2648f5a199b808df6e2e36611c4d4aa83c4db27293f542a6a298b
bubblewrap-debuginfo-0.3.3-2.el7at.x86_64.rpm	SHA-256: 2e6fa125d2dc601415bd3ccabd5f562ce97361cf17ad5f1a69c917c934a32f30
cfme-5.10.7.1-1.el7cf.x86_64.rpm	SHA-256: f0283213dac8652ddc9fb0625509c00632a1c96da87835c9e9a9c1a9e1d8977e
cfme-amazon-smartstate-5.10.7.1-1.el7cf.x86_64.rpm	SHA-256: c03067688c281622c60bdfd0d98c15cab31036599f0239147ac47806a65890c0
cfme-appliance-5.10.7.1-1.el7cf.x86_64.rpm	SHA-256: 6a07644ee32a84331981816171c70e02ac0c071f58d93da0987f0fd6dc8d3873
cfme-appliance-common-5.10.7.1-1.el7cf.x86_64.rpm	SHA-256: 134b20c81e7724c2879c1db31cf3974096894b10dab9adff24b0ddf5b0eb1ff1
cfme-appliance-debuginfo-5.10.7.1-1.el7cf.x86_64.rpm	SHA-256: f4eb12a7070e55bcedecf26499874c8db6256cd654909c247a85b38710c72a63
cfme-appliance-tools-5.10.7.1-1.el7cf.x86_64.rpm	SHA-256: 2c25baecfe94633bfb06f733ca33d29b8042b2ff1463e370e7739e06fd038065
cfme-debuginfo-5.10.7.1-1.el7cf.x86_64.rpm	SHA-256: c7a59a22c6510f3f0050d1bd564989ad90ffeb1acef523ce49dda4746aadb544
cfme-gemset-5.10.7.1-1.el7cf.x86_64.rpm	SHA-256: ab4657f0239a75c80e51e334f6fbc405381e3ee38b8cf677275e1f207654e114
cfme-gemset-debuginfo-5.10.7.1-1.el7cf.x86_64.rpm	SHA-256: 775ff3fe61a16f89c58a9cc8afc718e117f0a291dae47603562d0fa01b7c6da6
ovirt-ansible-hosted-engine-setup-1.0.20-1.el7ev.noarch.rpm	SHA-256: e03a1b918dbb1360ff605e36999a61f5ba701a1cd4288286dae5830a26bf301f
ovirt-ansible-image-template-1.1.11-1.el7ev.noarch.rpm	SHA-256: 8820c8320b93673c53863cd5c55a563e487ecd2067f6d228815b57b34e5f2134
ovirt-ansible-manageiq-1.1.14-1.el7ev.noarch.rpm	SHA-256: c07337ab8c0115d88671515d892e2b863af526c9f77f232045e677fd4584888b
ovirt-ansible-vm-infra-1.1.18-1.el7ev.noarch.rpm	SHA-256: 73a7384630527a5fbfc02cfc5462d7d621323cd9b7c6ecd9dee6588a9af0a143
python2-ansible-runner-1.3.4-2.el7ar.noarch.rpm	SHA-256: 1b7b2e794bceef9123aad2bf27c21f0d4df4e6b944268db3ba5dcfffb2184eaa