Topic

An update is now available for Red Hat Satellite 6.8 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Red Hat Satellite is a systems management tool for Linux-based
infrastructure. It allows for provisioning, remote management, and
monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258)
• netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)
• rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7663)
• puppet: puppet server and puppetDB may leak sensitive information via metrics API (CVE-2020-7943)
• jackson-databind: multiple serialization gadgets (CVE-2020-8840 CVE-2020-9546 CVE-2020-9547 CVE-2020-9548 CVE-2020-10968 CVE-2020-10969 CVE-2020-11619 CVE-2020-14061 CVE-2020-14062 CVE-2020-14195)
• foreman: unauthorized cache read on RPM-based installations through local user (CVE-2020-14334)
• Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover (CVE-2020-14380)
• Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS (CVE-2019-12781)
• rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)
• rubygem-secure_headers: limited header injection when using dynamic overrides with user input (CVE-2020-5216)
• rubygem-secure_headers: directive injection when using dynamic overrides with user input (CVE-2020-5217)
• rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks (CVE-2020-5267)
• puppet: Arbitrary catalog retrieval (CVE-2020-7942)
• rubygem-rack: directory traversal in Rack::Directory (CVE-2020-8161)
• rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names (CVE-2020-8184)
• hibernate-validator: Improper input validation in the interpolation of constraint error messages (CVE-2020-10693)
• puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL (CVE-2018-11751)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

• Provides the Satellite Ansible Modules that allow for full automation of your Satellite configuration and deployment.
• Adds ability to install Satellite and Capsules and manage hosts in a IPv6 network environment
• Ansible based Capsule Upgrade automation: Ability to centrally upgrade all of your Capsule servers with a single job execution.
• Platform upgrades to Postgres 12, Ansible 2.9, Ruby on Rails and latest version of Puppet
• Support for HTTP UEFI provisioning
• Support for CAC card authentication with Keycloak integration
• Add ability to upgrade Red Hat Enterprise Linux 7 hosts to version 8 using the LEAPP based tooling.
• Support for Red Hat Enterprise Linux Traces integration
• satellite-maintain & foreman-maintain are now self updating
• Notifications in the UI to warn users when subscriptions are expiring.

The items above are not a complete list of changes. This update also fixes
several bugs and adds various enhancements. Documentation for these changes
is available from the Release Notes document linked to in the References
section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Satellite 6.8 x86_64
• Red Hat Satellite Capsule 6.8 x86_64

Fixes

• BZ - 1160344 - [RFE] Satellite support for cname as alternate cname for satellite server
• BZ - 1261802 - [RFE] Make the foreman bootdisk full-host image work on UEFI systems
• BZ - 1300211 - capsule-certs-generate failed to increment release number when generating certificate rpm for foreman-proxy
• BZ - 1332702 - smart-proxy-openscap-send with additional features - alert if file corrupt
• BZ - 1398317 - For the vms built by Satellite 6 using "Network Based" installation mode on VMWare, unable to change the boot sequence via BIOS
• BZ - 1410616 - [RFE] Prominent notification of expiring subscriptions.
• BZ - 1410916 - Should only be able to add repositories you have access to
• BZ - 1429033 - Host provisioned with RHEL Workstation OS, after provisioning displayed as generic RedHat 7.3
• BZ - 1461781 - [RFE]A button should be available in the GUI to clear the recurring logics.
• BZ - 1469267 - need updated rubygem-rake
• BZ - 1486446 - Content view versions list has slow query for package count
• BZ - 1486696 - 'hammer host update' removes existing host parameters
• BZ - 1494180 - Sorting by network address for subnet doesn't work properly
• BZ - 1501499 - tomcat listens to 0.0.0.0 for serving requests but just needs localhost
• BZ - 1503037 - [RFE] Cancelled future/recurring job invocations should not get the status "failed" but rather "cancelled"
• BZ - 1505842 - Remote Execution engine: Error initializing command: Net::SSH::HostKeyMismatch - fingerprint 20:a9:b7:45:1a:b7:d6:42:1e:03:d1:1f:06:20:4c:e2 does not match for "172.17.0.101"
• BZ - 1531674 - Operating System Templates are ordered inconsistently in UI.
• BZ - 1537320 - [RFE] Support for Capsules at 1 version lower than Satellite
• BZ - 1543316 - Satellite 6.2 Upgrade Fails with error "rake aborted! NoMethodError: undefined method `first' for nil:NilClass" when there are custom bookmarks created
• BZ - 1563270 - Sync status information is lost after cleaning up old tasks related to sync.
• BZ - 1569324 - Webrick is unable to use 2 supported TLS v1.2 ciphers ('ECDHE-RSA-AES128-GCM-SHA256', 'ECDHE-RSA-AES256-GCM-SHA384')
• BZ - 1571907 - Passenger threads throwing tracebacks on API jobs after spawning
• BZ - 1576859 - [RFE] Implement automatic assigning subnets through data provided by facter
• BZ - 1584184 - [RFE] The locked template is getting overridden by default
• BZ - 1601101 - [RFE] Add autofill functionality to the Job invocation Search query box, copy from Hosts search box
• BZ - 1607706 - [RFE] Add support for --vlanid in Satellite Kickstart Default provisioning template
• BZ - 1608001 - Rearrange search/filter options on Red Hat Repositories page.
• BZ - 1613391 - race condition on removing multiple organizations simultaneously
• BZ - 1619274 - [RFE] Red Hat Satellite should now be able to discover and provision bare metal machines via UEFI HTTP boot
• BZ - 1619422 - User Agent for Downstream RSS feed still says Foreman and Foreman Version
• BZ - 1620214 - Page should auto-refresh after subscriptions have been modified on the Satellite webui
• BZ - 1624049 - Changing the organization in the Satellite WebUI does not change the sync plan page information from the previous organization
• BZ - 1625258 - Having empty "Allocation (GB)" when creating a new Host, nil:NilClass returned on creating the Host
• BZ - 1627066 - Unable to revert to the original version of the provisioning template
• BZ - 1630433 - [RFE] Include Ansible Satellite modules with Ansible Core modules
• BZ - 1630536 - yum repos password stored as cleartext
• BZ - 1632577 - Audit log show 'missing' for adding/removing repository to a CV
• BZ - 1640615 - CVE-2018-3258 mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018)
• BZ - 1645062 - host_collection controller responds with 200 instead of 201 to a POST request
• BZ - 1645749 - repositories controller responds with 200 instead of 201 to a POST request
• BZ - 1647216 - Lack of edit_smart_proxies permission causes error when setting host to Build
• BZ - 1647364 - [RFE] Extend the audits by the http request id
• BZ - 1647781 - Audits contain no data (Added foo to Missing(ID: x))
• BZ - 1651297 - Very slow query when using facts on user roles as filters
• BZ - 1653217 - [RFE] More evocative name for Play Ansible Roles option?
• BZ - 1654347 - Satellite may create duplicate CreateRssNotifications tasks after restarting foreman tasks
• BZ - 1654375 - [RFE] Mention specifically uder the admin chexbox for AD LDAP user if its created with admin role,
• BZ - 1659418 - katello-tracer-upload failing with error "ImportError: No module named katello"
• BZ - 1665277 - subscription manager register activation key with special character failed
• BZ - 1665893 - candlepin refuses to start or hangs periodically when having too many messages in ActiveMQ journal
• BZ - 1666693 - Command "hammer subscription list" is not correctly showing the comment "Guests of " in the "Type" field in the output.
• BZ - 1677907 - Ansible API endpoints return 404
• BZ - 1680157 - [RFE] Puppet 'package' provider type does not support selecting modularity streams
• BZ - 1680458 - Locked Report Templates are getting removed.
• BZ - 1680567 - Reporting Engine API to list report template per organization/location returns 404 error
• BZ - 1681619 - [RFE] Disable the option to enter a MAC address after selecting a compute resource while creating new hosts through Satellite
• BZ - 1685949 - [RFE] Support passing of attribute name instead of Id's in RHV workflow
• BZ - 1687116 - kernel version checks should not use /lib/modules to determine running version
• BZ - 1688886 - subscription-manager not attaching the right quantity per the cpu core
• BZ - 1691416 - Delays when many clients upload tracer data simultaneously
• BZ - 1697476 - [RFE] To be able to see the name of the provisioning template being used to build a host from the host itself
• BZ - 1702434 - foreman-bootloaders-redhat-tftpboot expected file permissions in package don't match runtime permissions
• BZ - 1705097 - An empty report file doesn't show any headers
• BZ - 1709557 - [RFE] warn the user if they have done a select all and it includes the restart|reboot service
• BZ - 1709842 - Tracer shows the machines needs rebooting even after reboot if kernel-debug is installed
• BZ - 1710511 - Filter by os_minor includes unexpected values on the Satellite web UI.
• BZ - 1715999 - Use Infoblox API for DNS conflict check and not system resolver
• BZ - 1716423 - Nonexistent quota can be set
• BZ - 1717403 - Broken breadcrumbs link to compute resource VM list on VM detail page
• BZ - 1718012 - [RFE] Add a hard limit of 100 items to restrict any fact child-hash/array
• BZ - 1718954 - [RFE] When the contentAccessMode is set to org_environment for an owner, we should disable auto-attach globally
• BZ - 1719509 - [RFE] "hammer host list" including erratas information
• BZ - 1719516 - [RFE] "hammer host-collection hosts" including erratas information
• BZ - 1720725 - [RFE] Ability to override DHCP options and wait_after_restart option for race condition
• BZ - 1721419 - SSH key cannot be added when FIPS enabled
• BZ - 1722954 - Slow performance when running "hammer host list" with a high number of Content Hosts (15k+ for example)
• BZ - 1723313 - foreman_tasks:cleanup description contain inconsistent information
• BZ - 1724494 - [Capsule][smart_proxy_dynflow_core] "PID file /var/run/foreman-proxy/smart_proxy_dynflow_core.pid not readable (yet?) after start"
• BZ - 1724497 - CVE-2019-12781 Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS
• BZ - 1726768 - [RFE] Red Hat Satellite 6 GUI, Tasks should show Full name
• BZ - 1729968 - Editing disk size of a Compute Profile for a VMware Compute Resource makes the whole Storage section disappear
• BZ - 1730083 - [RFE] Add Jobs button to host detail page
• BZ - 1731155 - Cloud init template missing snippet compared to Kickstart default user data
• BZ - 1731229 - podman search against Red Hat Satellite 6 fails.
• BZ - 1731235 - [RFE] Create Report Template to list inactive hosts
• BZ - 1733241 - [RFE] hammer does not inherit parent location information
• BZ - 1733650 - Satellite receives RPM1004 pulp error and 403 Forbidden http error retrieving packages from CDN
• BZ - 1736809 - undefined method `split' for nil:NilClass when viewing the host info with hammer
• BZ - 1737135 - Content Hosts loses subscriptions after Vmotion and auto attach is unable to assigned the subscriptions if any other subscription is already attached to the host.
• BZ - 1737564 - [RFE] Support custom images on Azure
• BZ - 1738548 - Parameter --openscap-proxy-id is missing in hammer host create command.
• BZ - 1740943 - Increasing Ansible verbosity level does not increase the verbosity of output
• BZ - 1743056 - While creating a host for a particular location, all the domains are in the pull down list, even if only one domain is selected for that location.
• BZ - 1743776 - Error while deleting the content view version.
• BZ - 1745516 - Multiple duplicate index entries are present in candlepin database
• BZ - 1746936 - satellite6 is not using remote execution by default even after setting remote execution by default from satellite web-UI.
• BZ - 1749692 - Default Rhel8 scap content does not get populated on the Satellite
• BZ - 1749916 - [RFE] Satellite should support certificates with > 2048 Key size
• BZ - 1751981 - Parent object properties are not propagated to Child objects in Location and Host Group
• BZ - 1752880 - katello-host-tools-tracer stats paths abusively, leading to a hang or slowness of yum command
• BZ - 1753551 - Traces output from Satellite GUI has mismatches with client tracer output
• BZ - 1756991 - 2 inputs with same name -> uninitialized constant #<Class:0x000000000b894c38>::NonUniqueInputsError
• BZ - 1757317 - [RFE] Dynflow workers extraction
• BZ - 1757394 - [BUG] Non-admin users always get "Missing one of the required permissions" message while accessing their own table_preferences via Satellite 6 API
• BZ - 1759160 - Rake task for cleaning up DHCP records on proxy
• BZ - 1761872 - Disabled buttons are still working
• BZ - 1763178 - [RFE] Unnecessary call to userhelp and therefore log entries
• BZ - 1763816 - [RFE] Report which users access the API
• BZ - 1766613 - Fact search bar broken and resets to only searching hostname
• BZ - 1766906 - Associating more than 10 Ansible roles to a Host only sets based on the per-page setting
• BZ - 1767497 - Compute Resource filter does not correctly allow Refresh Cache
• BZ - 1767635 - [RFE] Enable Organization and Location to be entered not just selected
• BZ - 1770366 - [RFE] Improve upgrade efficiency by moving RPM post-installation scripts to the installer.
• BZ - 1770544 - Puppet run job notification do not populate "%{puppet_options}"' value
• BZ - 1770777 - Changing concurrency level while executing Ansible jobs fail with NoMethodError: undefined method `[]' for nil:NilClass
• BZ - 1771367 - undefined method `request_uri' when Openidc Provider Token Endpoint is none
• BZ - 1771428 - Openscap documentation link on Satellite 6 webui is broke
• BZ - 1771484 - Client side documentation links are not branded
• BZ - 1771693 - 'Deployed on' parameter is not listed in API output
• BZ - 1772381 - Incorrect example to use multiple attributes as a matcher key in the tooltip for Order
• BZ - 1772517 - login with the user name as same as existing user group gives 500 ISE and wont allow user to login again
• BZ - 1772544 - Use APIv4 is not the default when creating a new compute resource in ovirt
• BZ - 1773298 - GET /katello/api/srpms/compare always fails with error: Missing template katello/api/v2/common/compare
• BZ - 1774710 - UI: When selecting the server type in ldap authentication, "attribute mappings" fields could be populated automatically
• BZ - 1778396 - exporting/importing report template process is causing a different report during the visualization (blank lines)
• BZ - 1778503 - Prepended text on OS name creation
• BZ - 1778681 - Some pages are missing title in html head
• BZ - 1779638 - Unable to filter/search http-proxies using Organization/Location for Satellite UI.
• BZ - 1781671 - While using concurrency_level in remote execution, job progress in WebUI is not being updated properly
• BZ - 1782352 - [RHEL 8.1 client] All packages are not getting updated after click on "Update All Packages"
• BZ - 1782426 - Viewing errata from a repository returns incorrect unfiltered results
• BZ - 1783568 - [RFE] - Bulk Tracer Remediation
• BZ - 1783882 - Ldap refresh failed with "Validation failed: Adding would cause a cycle!"
• BZ - 1784012 - Default kickstart places log to /mnt/sysimage/root/install.post.log
• BZ - 1784341 - disable CertificateRevocationListTask job in candlepin.conf by default
• BZ - 1785117 - [RFE] Add functionality in foreman logging to hash-out or mark as [FILTERED] the password in /var/log/foreman-maintain/foreman-maintain.log and /var/log/foreman-installer/satellite.log file
• BZ - 1785231 - Ansible Variable override to false does not gets reflected on client machine on Red Hat Satellite 6.
• BZ - 1785624 - [UI] Importing templates with associate 'never' is not resulting as expected
• BZ - 1785683 - Does not load datacenter when multiple compute resources are created for same VCenter
• BZ - 1785902 - Ansible RunHostJob tasks failed with "Failed to initialize: NoMethodError - undefined method `[]' for nil:NilClass"
• BZ - 1785940 - [RFE] Reporting template should allow host filtering based on applicable errata issue date
• BZ - 1787329 - change filename in initrd live CPIO archive to fdi.iso
• BZ - 1788261 - CVE-2018-11751 puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL
• BZ - 1788958 - [RFE] add "elapsed time" column to export and hammer, make it filterable in WebUI
• BZ - 1789006 - Smart proxy dynflow core listens on 0.0.0.0
• BZ - 1789100 - CVE-2019-16782 rubygem-rack: hijack sessions by using timing attacks targeting the session id
• BZ - 1789434 - Template editor not always allows refreshing of the preview pane
• BZ - 1789522 - On unhealthy Satellite, dynflow_envelopes table might grow indefinitely
• BZ - 1789686 - Non-admin user with enough permissions can't generate report of applicable errata
• BZ - 1789815 - The "start" parameter should be mentioned inside "--compute-attributes:" in hammer_cli for Satellite 6
• BZ - 1789911 - "foreman-rake katello:publish_unpublished_repositories" is referring to column which no longer exists in katello_repositories table.
• BZ - 1789924 - [RFE] As user I want to see a "disabled" status for Simple Content Access (Golden Ticketed) Orgs
• BZ - 1791654 - drop config_templates api endpoints and parameters
• BZ - 1791656 - drop deprecated host status endpoint
• BZ - 1791658 - drop reports api endpoint
• BZ - 1791659 - Remove `use_puppet_default` api params
• BZ - 1791663 - remove deprecated permissions api parameters
• BZ - 1791665 - drop deprecated compute resource uuid parameter
• BZ - 1792131 - [UI] Could not specify organization/location for users that come from keycloak
• BZ - 1792135 - Not able to login again if session expired from keycloak
• BZ - 1792174 - [RFE] Subscription report template
• BZ - 1792304 - When generating custom report, leave output format field empty
• BZ - 1792378 - [RFE] Long role names are cut off in the roles UI
• BZ - 1793951 - [RFE] Display request UUID on audits page
• BZ - 1794015 - When using boot disk based provisioning, sometimes foreman tries to recreate folder foreman_isos in the datastore even when the folder already exists
• BZ - 1794346 - Change the label for the flashing eye icon during user impersonation
• BZ - 1794641 - Sync status page's content are not being displayed properly.
• BZ - 1795809 - HTML tags visible on paused task page
• BZ - 1796155 - [RFE] host_collections not available in reporting engine unless safe mode disabled
• BZ - 1796205 - iso upload: correctly check if upload directory exists
• BZ - 1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling
• BZ - 1796259 - loading subscriptions page is very slow
• BZ - 1796697 - Unable to list/enable EUS repositories on the RHEL clients registered in the satellite server with org_environment contentAccessMode
• BZ - 1798489 - [RHSSO] - If Access Token Lifespan is set to 5 mins then the user is getting sign out instead after idle SSO timeout
• BZ - 1798668 - Configure default MongoDB WiredTiger cache to be 20% of RAM in the Satellite server
• BZ - 1799480 - CLI - hammer repository info shows blank sync status if the repository sync is in warning/error state.
• BZ - 1800503 - In Hammer, it is not possible to set default keyboard layout for a RHEV host
• BZ - 1801264 - CVE-2020-5217 rubygem-secure_headers: directive injection when using dynamic overrides with user input
• BZ - 1801286 - CVE-2020-5216 rubygem-secure_headers: limited header injection when using dynamic overrides with user input
• BZ - 1802529 - Repository sync in tasks page shows percentage in 17 decimal points
• BZ - 1802631 - Importing Ansible variables yields NoMethodError: undefined method `map' for nil:NilClass (initialize_variables) [variables_importer.rb]
• BZ - 1803846 - Red Hat Insights Risk Summary shows systems at risk while there are none
• BZ - 1804496 - While performing bulk actions, unable to select all tasks under Monitor --> Tasks page.
• BZ - 1804651 - Missing information about "Create Capsule" via webUI
• BZ - 1805501 - CVE-2020-10693 hibernate-validator: Improper input validation in the interpolation of constraint error messages
• BZ - 1805727 - Default Custom Repository download policy setting refers to old name (Default Repository download policy) in satellite 6.7
• BZ - 1806713 - hypervisor checkin fails with cp_consumer_hypervisor_ukey error
• BZ - 1806842 - Disabling dynflow_enable_console from setting should hide "Dynflow console" in Tasks
• BZ - 1806897 - Red Hat Inventory Uploads fail with NoMethodError: undefined method `mtu'
• BZ - 1807042 - [RFE] Support additional disks for VM on Azure Compute Resource
• BZ - 1807321 - A non-admin users with view recurring_logics permissions are unable to list recurring logics.
• BZ - 1807829 - Generated inventory file doesn't exist
• BZ - 1807946 - Multiple duplicate index entries are present in foreman database
• BZ - 1808843 - Satellite lists unrelated RHV storage domains using v4 API
• BZ - 1810250 - Unable to delete repository - Content with ID could not be found
• BZ - 1810549 - dropping packets to qdrouterd triggers a memory leak in qpid-proton 0.28.0-2 libraries used by goferd
• BZ - 1810774 - Applying errata via Host Collection the errata are trying to be applied to all hosts associated with the host collection
• BZ - 1811390 - Links to an errata list of a repository lack repositoryId in URI and points to generic "errata" page instead
• BZ - 1812031 - Improve regenerate applicability tasks performance by querying NEVRA only data from repo_content_units
• BZ - 1812858 - Satellite Inventory Plugin does not appear to make reports which match yupana's API specification
• BZ - 1812904 - 'Hypervisors' task fails with 'undefined method `[]' for nil:NilClass' error
• BZ - 1813005 - Prevent --tuning option to be applied in Capsule servers
• BZ - 1813313 - [Tracker] Test HTTP UEFI on IPv6 (QA only tracker)
• BZ - 1814095 - Applicable errata not showing up for module stream errata
• BZ - 1815104 - Locked provisioning template should not be allowed to add audit comment
• BZ - 1815135 - hammer does not support description for custom repositories
• BZ - 1815146 - Backslash escapes when downloading a JSON-formatted report multiple times
• BZ - 1815608 - Content Hosts has Access to Content View from Different Organization
• BZ - 1816330 - CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking
• BZ - 1816332 - CVE-2020-9546 jackson-databind: Serialization gadgets in shaded-hikari-config
• BZ - 1816337 - CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap
• BZ - 1816340 - CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core
• BZ - 1816699 - Satellite Receptor Installer role can miss accounts under certain conditions
• BZ - 1816720 - CVE-2020-7942 puppet: Arbitrary catalog retrieval
• BZ - 1816853 - Report generated by Red Hat Inventory Uploads is empty.
• BZ - 1817215 - Admin must be able to provide all the client ids involved inside Satellite settings.
• BZ - 1817224 - Loading one org's content view when switching to a different org
• BZ - 1817481 - Plugin does not set page <title>
• BZ - 1817728 - Default task polling is too frequent at scale
• BZ - 1817874 - After data upload from satellite UI it is not visible on cloud.redhat.com.
• BZ - 1818062 - Deprecated message about katello agent being shown on content host registration page
• BZ - 1818816 - Web console should open in a new tab/window
• BZ - 1819145 - [RFE] Incorporate apipie-dsl to document template macros, provided as one-time generated HTML document
• BZ - 1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider
• BZ - 1819212 - CVE-2020-10969 jackson-databind: Serialization gadgets in javax.swing.JEditorPane
• BZ - 1820193 - Deleted Global Http Proxy is still being used during repository sync.
• BZ - 1820245 - reports in JSON format can't handle unicode characters
• BZ - 1821182 - [Repository] - Packages are not getting synced with rpm-with-sha-512
• BZ - 1821335 - Inventory plugin captures information for systems with any entitlement
• BZ - 1821457 - [RFE] Capsules shouldn't update hosts' "Registered through" facts on the Satellite server in a load-balanced configuration.
• BZ - 1821629 - Eager zero seems to do nothing
• BZ - 1821651 - Manifest import task progress remains at 0.
• BZ - 1821752 - New version of the plugin is available: 1.0.5
• BZ - 1822039 - Get HTTP error when deploying the virt-who configure plugin
• BZ - 1822560 - Unable to sync large openshift docker repos
• BZ - 1823905 - Update distributor version to sat-6.7
• BZ - 1823991 - [RFE] Add a more performant way to sort reports
• BZ - 1824183 - Virtual host get counted as physical hosts on cloud.redhat.com
• BZ - 1824931 - After upgrading to Satellite 6.7 the Tasks page in WebUI goes "Blank"
• BZ - 1825760 - schedule inventory plugin sync failed due to 'organization_id' typecasting issue.
• BZ - 1825930 - [Regression] RedHat Insights client proxying stopped working due to missing proxy
• BZ - 1825978 - Manifest refresh failed with 'Katello::Errors::CandlepinError Invalid credentials.' error
• BZ - 1826298 - even when I cancel ReX job, remediation still shows it as running
• BZ - 1826340 - [RFE] Ability to provision a VM using Red Hat Gold BYOS images
• BZ - 1826515 - [RFE] Consume Candlepin events via STOMP
• BZ - 1826625 - Improve performance of externalNodes
• BZ - 1826678 - New version of the plugin is available: 2.0.6
• BZ - 1826734 - Tasks uses wrong controller name for bookmarks
• BZ - 1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop
• BZ - 1827389 - Manifest import and delete calls Actions::Pulp::Repository::Refresh for non-Library repositories
• BZ - 1827583 - Installing dhcp_isc and dhcp_remote_isc fails with "You cannot specify the same gem twice with different version requirements.....You specified: rsec (< 1) and rsec (>= 0)"
• BZ - 1828257 - Receptor init file missing [Install] section, receptor service won't run after restart
• BZ - 1828486 - CVE-2020-7943 puppet: puppet server and puppetDB may leak sensitive information via metrics API
• BZ - 1828549 - Manifest Certificate Exposed by Unprivileged User
• BZ - 1828682 - Create compute resource shows console error 'Cannot read property 'aDataSort' of undefined'
• BZ - 1828789 - [RFE] Satellite installer should support installing the Satellite Inventory Provider by default
• BZ - 1828868 - Add keep alive option in Receptor node
• BZ - 1829487 - Ansible verbosity level does not work
• BZ - 1829766 - undefined method `tr' for nil:NilClass when trying to get a new DHCP lease from infoblox
• BZ - 1830253 - Default job templates are not locked
• BZ - 1830403 - Capsule sync fails when promoting a content view to more than one lifecyle env at the same time
• BZ - 1830834 - Unable to update default value of a smart class parameter (Sql query error).
• BZ - 1830860 - Refactor loading regions based on subscription dynamically
• BZ - 1830882 - Red Hat Satellite brand icon is missing
• BZ - 1830884 - bootstrap.py script tries to yum install puppet package that is not in rhel-7-server-satellite-tools-6.7-rpms repo
• BZ - 1831528 - CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks
• BZ - 1833031 - Improve RH account ID fetching in cloud connector playbook
• BZ - 1833035 - Add remediation bulk ack message (i.e. all hosts for a given run has finished)
• BZ - 1833039 - Introduce error code to playbook_run_finished response type
• BZ - 1833311 - "Failed to save: Failed to save when overriding parameters for ansible, cause: Default value is invalid" while creating scap policy with ansible deployment option.
• BZ - 1834302 - --enable-foreman-plugin-rh-cloud fails: Execution of '/bin/yum -d 0 -e 0 -y install tfm-rubygem-foreman_rh_cloud' returned 1: Error: Nothing to do
• BZ - 1834377 - Disable mongo FTDC
• BZ - 1834866 - Missing macro for "registered_at" host subscription facet
• BZ - 1834898 - Login Page background got centralized and cropped
• BZ - 1835189 - Missing macro for "host_redhat_subscriptions" in host subscription facet
• BZ - 1835241 - Some applicability of the consumers are not recalculated after syncing a repository
• BZ - 1835882 - While executing "Configure Cloud Connector" playbook on Satellite 6.7 server it does not honour HTTP Proxy setting
• BZ - 1836155 - Support follow on rails, travis and i18n work for AzureRm plugin
• BZ - 1836771 - In satellite installation summary report, satellite should be mentioned instead of foreman.
• BZ - 1836774 - Some foreman services failed to start (pulp_streamer)
• BZ - 1836845 - "Generate at" in report template should be current date
• BZ - 1837951 - "invalid Unicode Property \p: /\b\perform various actions through those proxies\b(?!-)/" warning messages appears in dynflow-sidekiq@worker-hosts-queue
• BZ - 1838160 - 'Registered hosts' report does not list kernel release for rhsm clients
• BZ - 1838191 - Arrow position is on left rather in the middle under "Start Time"
• BZ - 1838281 - CVE-2020-8161 rubygem-rack: directory traversal in Rack::Directory
• BZ - 1838917 - Repositories are not showing their available Release versions due to a low default db pool size
• BZ - 1838963 - Hypervisors from Satellite, never makes their way to HBI
• BZ - 1838965 - Product name link is not working on the activation keys "Repository Sets" tab.
• BZ - 1839025 - Configure Cloud Connector relies on information which is no longer provided by the API
• BZ - 1839649 - satellite-installer --reset returns a traceback
• BZ - 1839726 - Bring tfm-rubygem-foreman_leapp to downstream builds
• BZ - 1839779 - undefined local variable or method `implicit_order_column' for #<ActiveRecord::Associations::CollectionProxy> on GET request to /discovery_rules endpoint
• BZ - 1839966 - New version of the plugin is available: 2.0.7
• BZ - 1840166 - ERF42-4995 [Foreman::Exception]: Invalid authenticity token message displayed with traceback, If re-login the machine after session timed-out .
• BZ - 1840191 - Validate parameters passed by receptor to the receptor-satellite plugin
• BZ - 1840218 - ArgumentError: wrong number of arguments
• BZ - 1840525 - Content host list doesn't update after the successful deletion of content host.
• BZ - 1840635 - Proxy has failed to load one or more features (Realm)
• BZ - 1840723 - Selected scenario is DISABLED, can not continue
• BZ - 1840745 - Satellite installation failed with puppet error " No Puppet module parser is installed"
• BZ - 1841098 - Failed to resolve package dependency while doing satellite upgrade.
• BZ - 1841143 - Known hosts key removal may fail hard, preventing host from being provisioned
• BZ - 1841573 - Clicking breadcrumb "Auth Source Ldaps" on Create LDAP Auth Source results in "The page you were looking for doesn't exist."
• BZ - 1841818 - icons missing on /pub download page
• BZ - 1842900 - ERROR! the role 'satellite-receptor' was not found in ...
• BZ - 1842943 - ~foreman-proxy/.ssh is a symlink to /usr/com/foreman-proxy/ssh/
• BZ - 1843406 - In 6.8, Receptor installation playbook's inputs are visible again
• BZ - 1843561 - Report templates duplicated
• BZ - 1843846 - Host - Registered Content Hosts report: "Safemode doesn't allow to access 'report_hraders' on #<Safemode::ScopeObject>"
• BZ - 1843867 - Satellite-installer failed with argument error while upgrading the satellite from 6.7 to 6.8
• BZ - 1843926 - satellite-change-hostname fails when running nsupdate
• BZ - 1844142 - [RFE] Drop a subsription-manager fact with the satellite version
• BZ - 1845112 - Installer deploys outdated version of pxegrub2 mac template to TFTP
• BZ - 1845486 - [RFE] Able to select 'HTTP Proxy' during Compute Resource create for 'GCE' as similar to EC2
• BZ - 1845860 - hammer org add-provisioning-template command returns Error: undefined method `[]' for nil:NilClass
• BZ - 1845978 - CVE-2020-7663 rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser
• BZ - 1846254 - need to restart services after enabling leapp plugin
• BZ - 1846313 - Add index on locks for resource type and task id
• BZ - 1846317 - undefined method `klass' for nil:NilClass
• BZ - 1846421 - build pxe default do not work when more than 1 provider
• BZ - 1846593 - Satellite-installer failed with error "Could not find a suitable provider for foreman_smartproxy" while doing upgrade from 6.7 to 6.8
• BZ - 1847019 - Empty applicability for non-modular repos
• BZ - 1847063 - Slow manifest import and/or refresh
• BZ - 1847407 - load_pools macro not in list of macros
• BZ - 1847645 - Allow override of Katello's DISTRIBUTOR_VERSION
• BZ - 1847784 - Error updating system data on the server, see /var/log/rhsm/rhsm.log for more details.
• BZ - 1847840 - Libvirt note link leads to 404
• BZ - 1847871 - Combined Profile Update: ArgumentError: invalid argument: nil.
• BZ - 1848291 - Download kernel/initram for kexec asynchronously
• BZ - 1848535 - Unable to create a pure IPv6 host
• BZ - 1848538 - Failed to resolve the packages due to tfm-runtime package dependency in fm-upgrade(6.7 to 6.8)
• BZ - 1848902 - ERF42-0258 [Foreman::Exception]: <uuid> is not valid, enter id or name
• BZ - 1848958 - CVE-2020-14195 jackson-databind: serialization in org.jsecurity.realm.jndi.JndiRealmFactory
• BZ - 1848962 - CVE-2020-14062 jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool
• BZ - 1848966 - CVE-2020-14061 jackson-databind: serialization in weblogic/oracle-aqjms
• BZ - 1848973 - capsule-certs-generate suggests running foreman-installer --scenario foreman-proxy-content instead of satellite-installer --scenario capsule
• BZ - 1849141 - CVE-2020-8184 rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names
• BZ - 1849656 - ERROR! You cannot use loops on 'import_tasks' statements. You should use 'include_tasks' instead.
• BZ - 1849680 - Task progress decimal precision discrepancy between UI, CLI, and API
• BZ - 1849869 - Unable to recycle the dynflow executor
• BZ - 1850355 - Auth Source Role Filters are not working in Satellite 6.8
• BZ - 1850536 - Can't add RHEV with APIv3 through Hammer
• BZ - 1850914 - Checksum type "sha256" is not available for all units in the repository. Make sure those units have been downloaded
• BZ - 1850934 - Satellite-installer failed with error "Could not evaluate: Proxy xyz..com cannot be retrieved: unknown error (response 502)"
• BZ - 1851017 - Position of text cursor in ace-editor wrong and hence unable to edit templates
• BZ - 1851030 - [RFE] Upgrade Ansible used from RHEL to be 2.9
• BZ - 1851167 - Autoattach -> "undefined" subscription added
• BZ - 1851176 - Subscriptions do not provide any repository sets
• BZ - 1851952 - "candlepin_events FAIL Not running" and wont restart
• BZ - 1852371 - Allow http proxy ports by default
• BZ - 1852723 - Broken link for documentation on installation media page
• BZ - 1852733 - Inventory upload documentation redirects to default location
• BZ - 1852735 - New version of the plugin is available: 2.0.8
• BZ - 1853076 - large capsule syncs cause slow processing of dynflow tasks/steps
• BZ - 1853200 - foreman-rake-db:migrate Fails on "No indexes found on foreman_tasks_locks with the options provided"
• BZ - 1853280 - Content view filter is excluding modules and Packages when published after upgrading the Satellite from 6.6 to 6.7
• BZ - 1853463 - Plugin does not upload inventory - Permission denied /var/lib/foreman/red_hat_inventory/uploads/uploader.sh
• BZ - 1853504 - [Regression] Hammer export-legacy Fails with Composite Content Views
• BZ - 1853572 - Broken documentation link for 'RHV' in Compute Resource
• BZ - 1854138 - System purpose status should show as 'disabled' when Satellite is in Simple Content Access mode.
• BZ - 1854397 - Compliance reports are not being uploaded to satellite.
• BZ - 1854530 - PG::NotNullViolation when syncing hosts from cloud
• BZ - 1855008 - Host parameters are set after the host is created.
• BZ - 1855254 - Links to documentation broken in HTTP Proxies setup
• BZ - 1855348 - katello_applicability accidentally set to true at install
• BZ - 1855710 - 'Ensure RPM repository is configured and enabled' task says 'FIXME'
• BZ - 1856370 - Clicking on any other tab other than overview while on capsule synchronizing page, redirects to overview page.
• BZ - 1856379 - Add missing VM creation tests
• BZ - 1856401 - [RFE] Add module to create HTTP Proxy
• BZ - 1856831 - New version of the plugin is available: 2.0.9
• BZ - 1856837 - undefined method '#httpboot' for NilClass::Jail (NilClass) when creating an IPv6 only host
• BZ - 1857124 - Attempting to attach a subscription to an unregistered host results in ISE 500
• BZ - 1857146 - Unable to build a host bootdisk image due to missing dosfstools package - Failed to format the ESP image via mkfs.msdos
• BZ - 1857184 - selinux is preventing to build a bootdisk iso - Failed to format the ESP image via mkfs.msdos
• BZ - 1857377 - Capsule Upgrade Playbook fails with "Failed to initialize: NoMethodError - undefined method `default_capsule' for Katello:Module"
• BZ - 1857506 - Capsule Upgrade Fail: satellite-installer --scenario capsule --upgrade throws NameError
• BZ - 1857572 - tailoring-file and scap-content command of hammer downloads file with wrong filename.
• BZ - 1857726 - Warnings are shown during the satellite package installation on RHEL 7.9
• BZ - 1858237 - Upgraded Satellite has duplicated katello_pools indexes
• BZ - 1858284 - CVE-2020-14334 foreman: unauthorized cache read on RPM-based installations through local user
• BZ - 1858819 - katello-certs-check output print foreman-installer--scenario katello instead satellite-installer --scenario satellite
• BZ - 1858855 - Creating compute resources on IPV6 network does not fail gracefully
• BZ - 1859158 - Unknown HTTPBoot EFI hosts are not directed to the grubx64.efi with a default grub conf
• BZ - 1859194 - load_hosts macro duplicated in a list of macros
• BZ - 1859276 - Need to update the deprecation warning message on Statistics and Trends page.
• BZ - 1859705 - Tomcat is not running on fresh Capsule installation
• BZ - 1859929 - User can perform other manifest actions while the first one starts
• BZ - 1860351 - 'Host - compare content hosts packages' report fails with error 'undefined method '#first' for NilClass'
• BZ - 1860407 - remote job-status table should not be re-loaded every second even if a job is running or completed
• BZ - 1860422 - Host with remediations can't be removed
• BZ - 1860430 - 'Host - compare content hosts packages' report: Safemode doesn't allow to access 'version'...
• BZ - 1860444 - After the system reboot, capsule setup(upgraded or newly installed 6.8 capsule) fails to start the tomcat service
• BZ - 1860519 - Browsing capsule /pub directory with https fails with forbidden don't have permission to access /pub/ error.
• BZ - 1860585 - Content Host Registration page showing version 6.7 for repos instead 6.8
• BZ - 1860587 - Documentation link in Administer -> About pointing to 6.6 document.
• BZ - 1860835 - Installed Packages not displayed on About page
• BZ - 1860957 - Unable to select an organization for sync management
• BZ - 1861367 - Import Template sync never completes
• BZ - 1861397 - UI dialog for Capsule Upgrade Playbook job doesn't state whitelist_options is required
• BZ - 1861422 - Error encountered while handling the response, replying with an error message ('plugin_config')
• BZ - 1861656 - smart-proxy-openscap-send command fails to upload reports to satellite.
• BZ - 1861724 - ipv6: host form in interfaces are showing Error generating IP: Bad Request
• BZ - 1861766 - Add ability to list traces by host with hammer
• BZ - 1861807 - Cancel/Abort button should be disabled once REX job is finish
• BZ - 1861816 - Error only on production builds: The Dynflow world was not initialized yet. If your plugin uses it, make sure to call Rails.application.dynflow.require! in some initializer
• BZ - 1861831 - satellite-change-hostname cannot change the satellite hostname after failing.
• BZ - 1861890 - Recommended repos do not match Satellite version
• BZ - 1861970 - Content -> Product doesn't work when no organization is selected
• BZ - 1862135 - updating hosts policy using bulk action fails with sql error
• BZ - 1862445 - compliance policy creation fails for ansible deployment option on upgraded satellite.
• BZ - 1862772 - Default repositories are not enabled, after registering a client with an Activation Key, to an org with Simple Content Access Mode in Red Hat Satellite 6
• BZ - 1865871 - Obfuscated hosts do not have domain reported
• BZ - 1865872 - Templates doc - examples on onepage.html are not processed
• BZ - 1865874 - Add inventory status to host
• BZ - 1865876 - Make recommendations count in hosts index a link
• BZ - 1865879 - Add automatic scheduler for insights sync
• BZ - 1865880 - Add an explanation how to enable insights sync
• BZ - 1865928 - Templates documentation help page has hard-coded Satellite setting value
• BZ - 1865943 - dynflow-sidekiq results in messages logs getting filled up more frequently
• BZ - 1866029 - Templates DSL documentation: Parts of description are put in <pre> tag
• BZ - 1866436 - host search filter does not work in job invocation page
• BZ - 1866461 - Run action is missing in job templates page
• BZ - 1866515 - ForemanVirtWhoConfigure::AuthSourceHiddenWithAuthentication is displayed on auth sources page
• BZ - 1866700 - Hammer CLI is missing "resolve" (traces) option for katello-tracer
• BZ - 1866710 - Wrong API endpoint path referenced for resolving host traces
• BZ - 1867239 - hammer content-view version incremental-update fails with ISE
• BZ - 1867287 - Error Row was updated or deleted by another transaction when deleting docker repository
• BZ - 1867311 - Upgrade fails when checkpoint_segments postgres parameter configured
• BZ - 1867399 - Receptor-satellite isn't able to deal with jobs where all the hosts are unknown to satellite
• BZ - 1867895 - API Create vmware ComputeResource fails with "Datacenter can't be blank"
• BZ - 1868183 - Unable to change virt-who hypervisor location.
• BZ - 1868971 - Receptor installation job doesn't properly escape data it puts into receptor.conf
• BZ - 1869640 - client-dispatcher: wrong number of arguments (given 0, expected 1..3) (ArgumentError)' messages come in upgrade and installation.
• BZ - 1869812 - Tasks fail to complete under load
• BZ - 1870657 - Make rake console run as a dynflow client to allow access to features provided by dynflow
• BZ - 1871016 - managercli.py:1364 - Error: Unable to retrieve service levels: HTTP error (404 - Not Found)
• BZ - 1871434 - theme css ".container" class rule is too generic
• BZ - 1871729 - ansible-runner implementation depends on third party repository for ansible-runner package.
• BZ - 1871815 - Satellite Ansible Collection - Provisioning a host fails with timeout
• BZ - 1871978 - Bug in provisioning_template Module
• BZ - 1872014 - Enable web console on host error in "Oops, we're sorry but something went wrong ERF42-5962 [Foreman::Exception]: No template mapped to feature Enable web console"
• BZ - 1872041 - Host search returns incorrect result
• BZ - 1873408 - Updating the CDN URL is manifest works fine but creates some tasks which remains in planned state with success result
• BZ - 1873926 - CVE-2020-14380 Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover
• BZ - 1874143 - Red Hat Inventory Uploads does not use proxy
• BZ - 1874160 - Changing Content View of a Content Host needs to better inform the user around client needs
• BZ - 1874168 - Sync Plan fails with 'uninitialized constant Actions::Foreman::Exception'
• BZ - 1874171 - [RFE] Allow Subscription-manager service plugin for zypper (SLES) to set autorefresh in repo file
• BZ - 1874172 - [6.7] Unable to re-import subscriptions in large environment (60k+ content hosts)
• BZ - 1874175 - After upgrading to 6.7 and promoting content, Capsule sync is extremely slow
• BZ - 1874176 - Unable to search by value of certain Hostgroup parameter
• BZ - 1874422 - Hits Sync uses only old proxy setting
• BZ - 1874619 - Hostgroup tag is never reported in slice
• BZ - 1875357 - After upgrade server response check failed for candlepin.
• BZ - 1875426 - Azure VM provision fails with error `requests.exceptions.HTTPError: 502 Server Error: Proxy Error for url`
• BZ - 1875660 - Reporting Template macros host_cores is not working as expected
• BZ - 1875667 - Audit page list incorrect search filter
• BZ - 1877307 - [Authentication] External auth login using Kerberos SSO is failing for AD and IDM on Satellite 6.8 only
• BZ - 1877354 - [Sat6/Bug] RHEL8 systems generate false positive warnings about repo binding
• BZ - 1877443 - Post Satellite 6.8 Upgrade AD authentication via LDAP fails when using an A record which returns 42 entries
• BZ - 1877452 - content set mappings for satellite-tools-6.8-for-rhel-8 AUS repos are missing from cdn/cs_mappings-*.csv
• BZ - 1877520 - content set mappings for satellite-tools-6.8-for-rhel-8 EUS repos are missing from cdn/cs_mappings-*.csv
• BZ - 1877542 - content set mappings for rhel7 satellite-tools-6.8 EUS repos are missing from cdn/cs_mappings-*.csv
• BZ - 1878194 - In Capsule upgrade, "yum update" dump some error messages.
• BZ - 1878556 - PXE provisioning in satellite 6.8 requires httpboot enabled
• BZ - 1878693 - Unable to perform image based deployment using hosts module from Red Hat Satellite Ansible Collections
• BZ - 1878850 - creating host from hg doesn't resolves the user-data template
• BZ - 1879151 - Remote execution status not updating with large number of hosts
• BZ - 1879448 - Add hits details to host details page
• BZ - 1879451 - Stop uploading if Satellite's setting is disconnected
• BZ - 1879453 - Add plugin version to report metadata
• BZ - 1879571 - unable to kexec discovered hosts - satellite tries to reach wrong IP
• BZ - 1880637 - [6.8] satellite-installer always runs upgrade steps
• BZ - 1881066 - Safemode doesn't allow to access 'host_cores' on #<Safemode::ScopeObject>
• BZ - 1881078 - Use Passenger instead of Puma as the Foreman application server
• BZ - 1881988 - [RFE] IPv6 support for Satellite 6.8
• BZ - 1882276 - Satellite installation fails at execution of '/usr/sbin/foreman-rake -- config -k 'remote_execution_cockpit_url' -v '/webcon/=%{host}''
• BZ - 1882389 - Search query in template for LEAPP upgrade should be pre-filled when running from pre-upgrade results
• BZ - 1883093 - installer-upgrade failed with error "Could not evaluate: Proxy XYZ.com cannot be retrieved: unknown error (response 500)"
• BZ - 1883472 - [Sat6.8/Bug] when registering more than ~240 in parallel getting this error "HTTP error (500 - Internal Server Error): Unable to register system, not all services available"
• BZ - 1887483 - Access insights pages refer to non-existing stylesheets, resulting in completely broken visuals
• BZ - 1887489 - Insights rules can't be loaded on freshly installed Satellite system
• BZ - 1887808 - Satellite-installer fails because of outdated RHSCL repository on DVD ISO

CVEs

• CVE-2018-3258
• CVE-2018-11751
• CVE-2018-1000119
• CVE-2019-10219
• CVE-2019-12781
• CVE-2019-16782
• CVE-2020-5216
• CVE-2020-5217
• CVE-2020-5267
• CVE-2020-7238
• CVE-2020-7663
• CVE-2020-7942
• CVE-2020-7943
• CVE-2020-8161
• CVE-2020-8184
• CVE-2020-8840
• CVE-2020-9546
• CVE-2020-9547
• CVE-2020-9548
• CVE-2020-10693
• CVE-2020-10968
• CVE-2020-10969
• CVE-2020-11619
• CVE-2020-14061
• CVE-2020-14062
• CVE-2020-14195
• CVE-2020-14334
• CVE-2020-14380

References