RHSA-2021:1313 - Security Advisory

Topic

An update is now available for Red Hat Satellite 6.9 for RHEL 7.

Description

Red Hat Satellite is a systems management tool for Linux-based
infrastructure. It allows for provisioning, remote management, and
monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• foreman: Managing repositories with their id via hammer does not respect the role filters (CVE-2017-2662)
• python-psutil: Double free because of refcount mishandling (CVE-2019-18874)
• candlepin: netty: compression/decompression codecs don't enforce limits on buffer allocation sizes (CVE-2020-11612)
• foreman: world-readable OMAPI secret through the ISC DHCP server (CVE-2020-14335)
• candlepin: resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling (CVE-2020-25633)
• python-django: potential SQL injection via "tolerance" parameter in GIS functions and aggregates on Oracle (CVE-2020-9402)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

• Usability enhancements to Red Hat's Simple Content Access mode and Satellite
• Usability improvements to enabling Remote Execution on your hosts.
• Notifications in the UI to warn users when subscriptions are expiring.
• Usability enhancements to enable Insights integration with Satellite.
• Performance improvements to various aspects of the user interface and API.
• Added support for OpenID Connect for authentication.
• Usability improvements to the Satellite Installer.
• Updated Ruby web server to the modern Puma application server which replaces Passenger.

The items above are not a complete list of changes. This update also fixes
several bugs and adds various enhancements. Documentation for these changes
is available from the Release Notes document linked to in the References
section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Satellite 6.9 x86_64
• Red Hat Satellite Capsule 6.9 x86_64

Fixes

• BZ - 1434106 - CVE-2017-2662 foreman: Managing repositories with their id via hammer does not respect the role filters
• BZ - 1439842 - Content View version delete fails with error "PLP0000: Pulp exception occurred: PulpExecutionException"
• BZ - 1459807 - Apply Errata to a Content Host via incremental C.V. has to wait till Capsule sync of the C.V. finishes
• BZ - 1470083 - Discovery settings 'Hostname_facts' should not be allowed to set empty
• BZ - 1526564 - [RFE] [sat-e-492] [SAT-506] allow adding arch and releasever to custom repos
• BZ - 1531536 - when I delete hosts where remote job was running, that finished remote job will start showing >100% result
• BZ - 1627812 - [RFE] There should be an API for getting the Satellite version and release
• BZ - 1654576 - "--order" and "--by" options of "hammer task list" doesn't work as expected.
• BZ - 1659506 - 'katello-certs-check' should display a warning messages if server.crt contains CN=shortname
• BZ - 1662478 - "openstack" in location/organization name is expanded into "RHEL OpenStack Platform"
• BZ - 1667647 - getting host details takes several times more for non-admin user
• BZ - 1677180 - [RFE] Provide the ability to use su as the effective method with password
• BZ - 1686641 - Unable to import job templates that have been exported from Satellite.
• BZ - 1686691 - [RFE] HTTP Proxy should provide "http_proxy" and "https_proxy" two options, not only "http_proxy" as default.
• BZ - 1690550 - [RFE] customize/branding/theming of Satellite title bar to help distiguish multiple Satellites from each other, aka POC/Test/Prod
• BZ - 1694868 - Non-Admin user can see All Remote Execution Jobs initiated by other users
• BZ - 1698395 - satellite-installer fails with traceback when there is a log file with name /var/log/foreman-installer/satellite.log-$something-$date.log
• BZ - 1699188 - Adding search for Operating system in role's host filter with permission view_hosts does not construct SQL query when API is used
• BZ - 1701075 - Subnet is blank after provisioning a discovered host via customize Host form
• BZ - 1722799 - Unclear / incomplete error message while trying to promote a content view with a user that has insufficient permissions
• BZ - 1725817 - Ansible Power job fails silently
• BZ - 1726288 - Can edit template inputs of locked template through CLI and API
• BZ - 1726293 - In a locked template, (only) "Value Type" field is not greyed out
• BZ - 1741943 - Postgres usage spikes and disk space completely filled up, when non-admin select Monitor -> Tasks
• BZ - 1746218 - [RFE] - Job Invocations: Need Word Wrap for Long Filenames in "Description" Field (All Browsers).
• BZ - 1747515 - [RFE] Ability to refresh the task states by clicking on a refresh button rather than refreshing the whole page\session
• BZ - 1752492 - Stopped chart does not contain cancelled tasks
• BZ - 1752914 - Hammer: undefined method `[]' for nil:NilClass
• BZ - 1754497 - Two tooltips shown over capsule name at the same time
• BZ - 1762346 - Upgrade from 6.4 to 6.5 fails at db:migrate Due to 20190205142619_add_content_constraints Migration
• BZ - 1767040 - [RFE] Satellite web UI should not show "Full Trace" when someone provides invalid search input
• BZ - 1772014 - CVE-2019-18874 python-psutil: double free because of refcount mishandling
• BZ - 1772526 - Each start of qpidd causes error Error reading socket: Encountered end of file
• BZ - 1772781 - [RFE]Ability to use Content Hosts search filters in Insights Inventory
• BZ - 1774378 - qdrouter might segfault when goferd drops connection just when it timeouts
• BZ - 1776470 - BMC feature is not able to select correct proxy if configured on the multiple Capusle Server
• BZ - 1777293 - When importing multiple ansible role variables in satellite that have the same variable name, they are silently overwritten.
• BZ - 1781469 - Non-standard branding in web UI
• BZ - 1785250 - When setting foreman_tasks_proxy_batch_trigger to false ansible jobs configured in satellite do not work anymore
• BZ - 1787335 - Error: PLP0034: The distributor indicated a failed response when publishing repository.
• BZ - 1791025 - Unable to use Organization ID in report templates using CLI
• BZ - 1793875 - Job Invocations page is extremely slow for non-admin users
• BZ - 1800870 - "Ansible report timeout" setting is ignored as report origin is not properly set
• BZ - 1804505 - Remote execution with sudo will fail if the ssh password contains regex meta-characters.
• BZ - 1804624 - In Tasks page, under Stopped section, add a space between the picture and text (Error, Warning and Success)
• BZ - 1807073 - Unable to render iPXE template 'Kickstart default iPXE': no implicit conversion of URI::HTTP into String"]
• BZ - 1807789 - Root password in the provisioning settings should be encrypted instead of plain text.
• BZ - 1810088 - CVE-2020-9402 django: potential SQL injection via "tolerance" parameter in GIS functions and aggregates on Oracle
• BZ - 1812182 - RHV compute profiles using VM templates always enable (and re-enable) the "Highly Available" bit regardless of setup on RHV side
• BZ - 1812227 - WebUI spinner spins forever when clicking a column within Ansible config report
• BZ - 1813986 - Array handled improperly, leading to ISE
• BZ - 1816216 - CVE-2020-11612 netty: compression/decompression codecs don't enforce limits on buffer allocation sizes
• BZ - 1817320 - Failed to run ansible job when disabling "foreman_tasks_proxy_batch_trigger"
• BZ - 1818053 - Clicking on the Dynflow console button before API calls are complete yields an Internal Server Error
• BZ - 1819150 - [RFE] Incorporate apipie-dsl to document template macros, provided as in-app documentation
• BZ - 1820237 - Per page not changed on All Hosts page after setting "Entries per page"
• BZ - 1824959 - [RFE] [sat-e-492] Activation Key repository list should be in 'Show All' mode by default with Organization Env Access aka Simple Content Access
• BZ - 1825458 - Showing a Job Invocation should have an option to list outcome on individual Hosts
• BZ - 1826453 - "Maximize" button in Template editor does not work in Chrome
• BZ - 1827590 - running ReX via receptor is very ineffective, satellite load is at least 90% higher, ReX job on 500 hosts gets cancelled
• BZ - 1829266 - Incremental update of the content view takes very long time to complete
• BZ - 1835122 - [Satellite 6] - API PING request return "status": "ok" even if there is a service in state failed
• BZ - 1835539 - HTTP proxy password got reset to empty string after editing can cause 407 "Proxy Authentication Required" error
• BZ - 1837717 - Ansible temporary files are not removed from the /tmp directory.
• BZ - 1837960 - Denial when clicking on Web Console button
• BZ - 1840054 - [RFE] Make sure every Page does show a valid title in browser
• BZ - 1840533 - Don't ship foreman-proxy-selinux in satellite and capsule repos
• BZ - 1841048 - [RFE] Ability to specify REX interface upon registration
• BZ - 1843710 - names of unlimited SKU's are visible on the subscriptions page but activation key does not show any names
• BZ - 1844151 - [RFE] Need a way to print the complete input of a REX job using the hammer command line on Red Hat Satellite 6.
• BZ - 1844344 - Why "satellite-capsule" package exists under satellite repository
• BZ - 1845113 - Subscription Watch SLA filter does not honors "service level" set to system when registered using activation key
• BZ - 1846679 - satellite-installer/capsule-certs-generate can not handle '-S' in the argument
• BZ - 1846696 - Oops page when trying perform action on all systems from content host page
• BZ - 1847073 - Login page footer should be a footer below the login pane
• BZ - 1850440 - "hammer status" returns 500 ISE when a Capsule or Satellite has foreman-proxy "logs" feature disabled
• BZ - 1851379 - Smart proxy dynflow core logs are missing newlines
• BZ - 1851382 - SSH debug logging doesn't show any useful data
• BZ - 1852594 - [RFE] Anonymize and reduce subscription-watch data
• BZ - 1852683 - Activation key page loading is very slow
• BZ - 1853681 - User without generate_foreman_rh_cloud permission can try to generate report
• BZ - 1854026 - Failed to publish content view: "PG::UniqueViolation: ERROR: duplicate key value violates unique constraint "index_katello_docker_meta_tags_on_schema1_id_and_schema2_id" DETAIL: Key (schema1_id, schema2_id)"
• BZ - 1856758 - foreman-proxy ssh key is copied 3 times to the provisioned machine in /root/.ssh/authorized_keys
• BZ - 1857176 - Users have to delete ssl-build/<capsule> directory and regenerate the certificates to add a cname in capsule certificates
• BZ - 1857198 - Unwrappable long role name overlaps into description
• BZ - 1857258 - [RFE] Give Satellite operation jobs their own Job Category
• BZ - 1858145 - Host errata status not refresh after CV publish/promote
• BZ - 1858302 - CVE-2020-14335 foreman: world-readable OMAPI secret through the ISC DHCP server
• BZ - 1860928 - Last checkin date/time not update when hypervisor is checked in via virt-who
• BZ - 1868005 - Selinux blocks websockify, vnc console is blocked
• BZ - 1868145 - Content view/version list option/module not avaialble
• BZ - 1868303 - Updating new role shows 'The page you were looking for doesn't exist.'
• BZ - 1868800 - [RFE]: Control for executing the job from the Satellite to the Satellite needs to be implemented in the process
• BZ - 1868901 - Remote Execution Capsules are not listed when querying the subnet using API and hammer.
• BZ - 1870035 - The "grubx64.efi" provided by latest grub2-efi-x64-2.02-0.86.el7_8.x86_64 package have broken PXE based discovery for EFI systems on Satellite 6.7
• BZ - 1870584 - Change Owner option is missing in bulk actions on Hosts/All Hosts page
• BZ - 1871057 - The field for manual IP address config is too short for IPv6
• BZ - 1871257 - Change kexec options used on FDI to work on systems using UEFI + SecureBoot
• BZ - 1872161 - When deleting a content view version, all hosts have been listed as affected even hosts are not using it
• BZ - 1873391 - No longer able to tag docker image using hammer after upgrading to Satellite 6.7/6.8
• BZ - 1873792 - [RFE] Allow option to deploy hosts with GOFERLESS configuration from Satellite 6
• BZ - 1874850 - Publishing new CCV version after making changes in the underlying CVs' puppet modules does not check for conflicts before starting the publish task
• BZ - 1874930 - Toggling Simple Content Access does not update host Subscription status
• BZ - 1874937 - Allowlist the owner_content_access_mode.modified event in Candlepin broker.xml
• BZ - 1875314 - [RFE] Cannot delete content view due to associated environments
• BZ - 1878034 - [RFE] Add/override interfaces to provisioned hosts
• BZ - 1878300 - API doc is incorrect for /api/hosts/bulk/available_incremental_updates
• BZ - 1879042 - CVE-2020-25633 resteasy-client: potential sensitive information leakage in JAX-RS RESTEasy Client's WebApplicationException handling
• BZ - 1879126 - no-op repo sync leads to real-op repo publish in certain situations
• BZ - 1879523 - [ALL_LANG] [SAT_6.8 | 6.9 ] Strings at pagination sections are not marked as translatable strings.
• BZ - 1879537 - Any product disabled/removed from Red Hat Satellite 6, should automatically disassociate from sync plan
• BZ - 1879587 - simultaneous POST requests to some endpoints result in Different response payload format
• BZ - 1881150 - foreman-maintain package lock check indicates false failure
• BZ - 1881299 - Product advance sync: link to task is text
• BZ - 1881383 - [RFE] Add ability to search job invocations by ID
• BZ - 1882248 - FAM theforeman.foreman.repository errors out when no change needed
• BZ - 1882690 - Redhat repos are no longer listed completely
• BZ - 1883722 - Web UI shows duplicate rpms when user uploads the same rpm that signed with different checksum
• BZ - 1884237 - receptor-satellite allows inconsistent combination of status codes
• BZ - 1884573 - Order of organizations on Inventory screen is different than order in organization picker
• BZ - 1884582 - Inventory upload page not filtering organization and instead showing all of them at once.
• BZ - 1884796 - os_release field is showing "()" for vmWare hypervisors in report JSON
• BZ - 1885846 - Deprecate ovirt v3
• BZ - 1886023 - There should be a strict requirement for the Ansible version
• BZ - 1886061 - [RFE] Reporting Macro showing System Installation Date
• BZ - 1886876 - hammer org remove-provisioning-template command returns error
• BZ - 1887504 - katello-certs-check doesn't validate if there is a SAN that matches the Subject CN in custom certificates
• BZ - 1887511 - Satellite upgrade to 6.7.3 version fails at disabling sync plan stage with error 'Cannot update a cancelled Recurring Logic'
• BZ - 1888627 - [RFE] Introduce a remote execution job which can automate the upgrade of the capsule infrastructure.
• BZ - 1888984 - Hypervisors being reported with number_of_cpus and cores_per_socket == 0
• BZ - 1889320 - Installer fails with NoMethodError: undefined method `permissions' for nil:NilClass
• BZ - 1889662 - Add sorting and searching by recommendations count
• BZ - 1889690 - Add IPv4 obfuscation
• BZ - 1889795 - uncaught exception after a celery worker process abruptly terminates, resulting in a hung task
• BZ - 1889951 - [RFE] Allow ansible_roles and inherited_ansible_roles in Host and HostGroup jail so it can be used in report templates
• BZ - 1889952 - [DOC] incomplete documentation for os_default_template
• BZ - 1890629 - [RFE] [sat-e-492] Disable SCA toggle in UI if the Candlepin request would fail
• BZ - 1890636 - [RFE] [sat-e-492] Change Sub Watch links and SCA banner message
• BZ - 1890643 - [RFE] [sat-e-492] [SAT-502] In Organization details, show Simple Content Access status
• BZ - 1890658 - [RFE] [sat-e-492] Allow the user to toggle Simple Content Access on/off
• BZ - 1890660 - [RFE] [sat-e-492] [SAT-505] Remove both Subscription widgets from Dashboard when SCA is enabled
• BZ - 1890661 - [RFE] [sat-e-492] [SAT-500] As a user, I should not be able to attach a subscription to a host with SCA enabled
• BZ - 1890664 - [RFE] [sat-e-492] [SAT-499] As a user, I should not be able to attach a subscription to an activation key with SCA enabled
• BZ - 1890683 - [RFE] smartly sync capsules with history tracking
• BZ - 1892361 - When in Simple Content Access mode, hypervisors with no subscription attached show as 'unsubscribed hypervisor' in their Subscription sub-status
• BZ - 1892727 - update of DNS records fails with IPv6 address - invalid rdata format: bad dotted quad
• BZ - 1893439 - rh_cloud is reporting 588 hosts, however, in red hat insights inventory we can see only 180
• BZ - 1893512 - Update deprecation notification for dropping API v3
• BZ - 1894009 - Generating Red Hat cloud inventory fails if there are foreman_hooks available
• BZ - 1894159 - [RFE] Set System Purpose on multiple hosts via bulk action UI
• BZ - 1895037 - Red Hat Insights Sync not working on Satellite 6.8
• BZ - 1895324 - hammer task resume has broken.
• BZ - 1895330 - Update the foreman-discovery-image with newer kernel
• BZ - 1896038 - Satellite upgrade from 6.7 to 6.8 fails
• BZ - 1896674 - [RFE] Remove statistics and trends
• BZ - 1896785 - After upgrade the Satellite tfm-rubygem-foreman_remote_execution-cockpit package the WebConsole stop to work.
• BZ - 1897268 - satellite-installer --help display some un-necessary information.
• BZ - 1897281 - Satellite installer displayed upgrade information after Satellite install.
• BZ - 1897297 - katello-certs-check output print foreman-installer--scenario katello instead satellite-installer --scenario satellite
• BZ - 1897344 - Candlepin stops responding and webgui fails with SSL_connect error
• BZ - 1897360 - candlepin_events service not running, tomcat SELinux denial
• BZ - 1897509 - Switch button doesn't work in the virt-who edit page
• BZ - 1898367 - Applying errata from the errata's page always tries to use katello-agent even when remote_execution_by_default set to true
• BZ - 1898450 - Unable to import Ansible Variables from Satellite UI.
• BZ - 1898645 - WebUI message "Deprecation Warning: Puppet and OStree will no longer be supported in Katello 4.0" refers to upstream component and not Satellite
• BZ - 1898826 - yum update failed to resolve dependencies
• BZ - 1898859 - Set Global Parameter 'host_registration_insights' to true
• BZ - 1899108 - Capsule-certs-generate not working with relative and absolute path
• BZ - 1899158 - search in job templates fail with error "undefined method `resource_type' for nil:NilClass"
• BZ - 1899407 - satellite-installer --list-scenarios failed with NamedError
• BZ - 1899574 - add 'context' to AvailableModuleStream host modularity profile
• BZ - 1899962 - Settings table is not updated immediately after making a change in the UI
• BZ - 1900533 - responses to /api/v2/settings/<id> no longer contain 'created_at' and 'updated_at' attrs
• BZ - 1900694 - Global registration fails with Validation failed: Name can't be blank
• BZ - 1900737 - puppet run fails with error parameter 'port' expects a Stdlib::Port = Integer[0, 65535] value, got String
• BZ - 1901031 - ansible-runner epel repository is created/enabled on Satellite 6.9
• BZ - 1901051 - RH Cloud settings are missing names
• BZ - 1901136 - Add 'upgrade rubygem-foreman_maintain to latest version' task in Capsule Upgrade Playbook.
• BZ - 1901392 - Issue when refreshing the User Group with "." as part of the name, for example "grp.01"
• BZ - 1901716 - Cannot change Organization\Location of existing host using redhat.satellite.host module
• BZ - 1902199 - virt-who plugin does not show HTTP Proxy details using API and hammer CLI
• BZ - 1902732 - unable to pull images from public docker registry
• BZ - 1903046 - Retry for connection reset by peer doesn't work when syncing docker repository
• BZ - 1903101 - Link to Provisioning templates docs is missing from /about page
• BZ - 1903247 - Cannot build a RHEL 8.3 system via Satellite Full Host Bootdisk or Discovery kexec
• BZ - 1903599 - [QE Tracker] [EPIC] Simple Prescriptive Install
• BZ - 1903626 - foreman-rake katello:receptor:extract_orgs fails with Dynflow world was not initialized
• BZ - 1903989 - reports:daily trigger mail notification twice
• BZ - 1905041 - Missing hammer command "hammer scap-content bulk-upload".
• BZ - 1905096 - [RFE] Remove puppetrun functionality
• BZ - 1905500 - Assign registration template when creating Red Hat OS
• BZ - 1905567 - compliance/scap_contents/bulk_upload API endpoint not working.
• BZ - 1905727 - Foreman Discovery Image 3.6.7 Doesn't Allow Static IP Assignment
• BZ - 1905731 - Satellite 6.8 upgrade results in empty /var/opt/rh/rh-postgresql12/lib/pgsql/data which causes upgrade to fail
• BZ - 1905953 - [Regression] Cancelled pulp task remaining running until finish
• BZ - 1905979 - System Purpose bulk setting is not reflected on host
• BZ - 1906164 - [RFE] Provide erratum.synopsis option to Applicable errata Reporting template
• BZ - 1906317 - "undefined method `name' for nil:NilClass" while switching organization from template invocation page.
• BZ - 1907864 - Repository enable failed on http-proxy configured setup.
• BZ - 1907992 - Subsequent click of Tasks search button do not search again
• BZ - 1908015 - Discovered host is assigned a taxonomy at random and Satellite fails to honor the correct taxonomy when loading and matching discovery rules
• BZ - 1908141 - Wrong message output when running hammer repository list --content-view-id <id> --organization-id <id>
• BZ - 1908237 - [Installer] Installer timeout when executing foreman-rake db:migrate
• BZ - 1909768 - hammer content-view version export-histories failing for '--help' flag
• BZ - 1910087 - The selected kickstart repository is not part of the assigned content view, lifecycle environment, content source, operating system, and architecture
• BZ - 1910759 - GET "/api/v2/permissions" Is failing with 500 Internal Server Error Fails only in 6.9
• BZ - 1911228 - In the settings, Failed to set null value in the discovery_prefix.
• BZ - 1911341 - While using satellite-installer --reset-data throws few "Permission Denied" errors
• BZ - 1911641 - Each smart class parameter appears twice, when having two environments
• BZ - 1912209 - Capsule sync failed with "no record found error"(ActiveRecord::RecordNotFound: Couldn't find Katello::Repository with 'id').
• BZ - 1912219 - Some of the settings contain a blank name
• BZ - 1912704 - puppetlabs_repo snippet incorrectly references puppet release files as puppetlabs-release rather than puppet-release
• BZ - 1913259 - FDI does not boot on HyperV 2016 VM due to missing SCSI driver in initram disk
• BZ - 1913274 - "can not set password with opaque" error on settings page after creating Http proxy with invalid url.
• BZ - 1913290 - Settings "Content" page disappeared after setting the http-proxy.
• BZ - 1913470 - Migration plugin can't query content from mongo in order
• BZ - 1913477 - In case of any issues in the middle of pre-migration, migration re-run doesn't pick up all the needed content.
• BZ - 1913733 - Satellite upgrade failed with transaction check error.
• BZ - 1914014 - Host group content facet not getting migrated
• BZ - 1914256 - unable to clear http_proxy_except_list setting ones set.
• BZ - 1914359 - creating a puppet repo with pulp3 installed but not running results in ' A capsule seems to have been refreshed without pulpcore being running. You may want to'
• BZ - 1915342 - foreman_hooks: json representation of the hook object is limited / incorrect during create hook
• BZ - 1915347 - foreman-proxy-certs-generate fails with custom certificates
• BZ - 1915872 - Satellite cannot deploy hosts when using content view due to kickstart repo id mismatching.
• BZ - 1915943 - Puppet Environments are not listed properly in the SCP details page
• BZ - 1916302 - support skip_corrupted=True for pulp 2to3 migration
• BZ - 1916307 - [RFE] Add insecure checkbox to the registration form
• BZ - 1916361 - "'NoneType' object is not subscriptable" error during pulp 2to3 migration
• BZ - 1916485 - pulp3: content migration may fail if pulp isn't up yet
• BZ - 1916849 - User drop down menu(upper right corner) under sync status is whited out
• BZ - 1916878 - Update recommended repos for sat/tools from 6.8 to 6.9
• BZ - 1916892 - Global Registration: Automatically associate Operating System with registration templates.
• BZ - 1917076 - Wrong deps are added when publishing content view with "solve_dependencies=true"
• BZ - 1917267 - Shorten the Satellite installer verbose STDOUT
• BZ - 1917299 - Satellite-installer failed to register Satellite with Red Hat Insights.
• BZ - 1918167 - unable to set "Default HTTP Proxy" field to "no global default".
• BZ - 1918322 - pulp 3 packages conflict with python2-future if pulp-admin is installed
• BZ - 1918463 - Unable to create repositories in Pulp 3 mode with Firefox as the browser - username : This field may not be blank.
• BZ - 1918464 - check service status bats test failure
• BZ - 1918474 - Organization delete fails trying to ping Pulp 3
• BZ - 1918482 - Update pulpcore-selinux to 1.1.4
• BZ - 1918487 - Create secure Pulp 3 deployment layout on disk
• BZ - 1918502 - Copying an advisory also copies over unrelated content
• BZ - 1918507 - repository update immediately after repository creation fails due to race condition {"base_path":["This field must be unique."]}
• BZ - 1919566 - Global Registration: should not allow to generate command if 'Activation Key' has been kept blank.
• BZ - 1919958 - Global Registration: page does not pre-populate values for "Setup Insights" & "Remote Execution" from Global Parameters
• BZ - 1919960 - [RFE] Global Registration: wizard should let users know which fields are mandatory
• BZ - 1920000 - Font size cause overlaps contents with default browser settings
• BZ - 1920014 - Sync now on Insights does nothing
• BZ - 1920031 - Module Streams documentation link does not navigate
• BZ - 1920545 - Cancel is outside of the table on sync status page during synchronization
• BZ - 1920556 - UI not getting updated when you modify entitlements quantity like add or less in subscriptions
• BZ - 1920561 - pool id in exported csv from subscription page are wrong
• BZ - 1920566 - Saving bookmark with an existing/duplicate bookmark name doesn't show a clear error
• BZ - 1920819 - 'Applied Errata' report fails with error 'no implicit conversion of nil into Array'
• BZ - 1920830 - Report template "Last Checkin" fails when "Include unknown" is set to false
• BZ - 1920860 - The Start Date field is blank for Subscriptions within Content Hosts page in Satellite WebUI
• BZ - 1921059 - Global Registration: Registration tab does not provide registration in the script
• BZ - 1921150 - Tasks view fails for non-admin with PG::SyntaxError: ERROR: syntax error at or near "'1,6,4,3,5'"
• BZ - 1921491 - Global Registration: Activation key info contain 'Centos'
• BZ - 1921796 - db seed fails with 'Unknown remote execution feature katello_module_stream_action'
• BZ - 1921810 - syncing a repo with an erratum without an updated date results in a bad date in published metadata (upgrade to pulp-rpm 3.9)
• BZ - 1922134 - User with viewer role can see "Create Content View" button
• BZ - 1923209 - hammer content-view filter delete fails
• BZ - 1923661 - Wrong link to documentation in Ansible Role page
• BZ - 1924265 - Custom subscriptions showing entitlements as -1 on Subscriptions page
• BZ - 1924592 - [RFE][sat-e-612] Cloud Connector Simplification
• BZ - 1925258 - Template sync fails with error Oh no! Something went wrong
• BZ - 1925616 - a candlepin SELinux denial that can appear when doing a change hostname sometimes
• BZ - 1925799 - Pulp 3: Unable to synchronize custom yum repository in Pulp 3 mode: ["''true'' value must be either True or False."]
• BZ - 1926100 - undefined local variable or method `foreman_inventory_upload_index_path' error while trying to download report.
• BZ - 1926554 - The wrong hyperlink for the jobs documentation button in satellite6.8 web UI.
• BZ - 1927701 - Update to rubygem-smart_proxy_discovery_image-1.3.2-1.el7sat.noarch.rpm
• BZ - 1927842 - Bogus output of `foreman-rake katello:receptor:extract_orgs`
• BZ - 1927930 - pulp3 - Distribution tree parsing fails if is_layered configuration parameter is present
• BZ - 1928264 - Receptor service fails to run on Satellite 6.9 Beta
• BZ - 1928652 - Removing a host from fails with PG::ForeignKeyViolation: ERROR
• BZ - 1929334 - pulp3: If orphaned content is removed in pulp 2 between migration re-runs, FileNotFoundError is raised
• BZ - 1929344 - pulp3: Worker has gone missing during migration (likely due to I/O load)
• BZ - 1929374 - pulp3: Ensure a migration can be interrupted within reasonable time at any stage
• BZ - 1929380 - pulp3: Handle migration when same distributor is being re-used for different repositories in between the plans
• BZ - 1929385 - pulp3: Improve migration re-run times if there were no or very little changes in pulp 2
• BZ - 1929392 - pulp3: Migration reset() requires both href and the migration plan as a string for Ruby bindings
• BZ - 1929393 - pulp3: 'NoneType' object has no attribute 'cast' on metadata_checksum_type
• BZ - 1929395 - pulp3: Migration fails with ForeignKeyViolation: insert or update on table "pulp_2to3_migration_pulp2erratum" violates foreign key constraint "pulp_2to3_migration
• BZ - 1929660 - 'undefined method `length' for nil:NilClass' error for Red Hat Insights page.
• BZ - 1930151 - Refactor insights-client uploads process to rh_cloud plugin.
• BZ - 1930165 - Remediate button for insights recommendation does nothing.
• BZ - 1930223 - pulp3: installer changes needed for pulp content app
• BZ - 1930334 - katello_yum_metadata_files record has migrated_pulp3_href NULL value
• BZ - 1930641 - when I execute remediation from cloud.redhat.com on 1 host, it executes on Sat but on c.r.c it says "running" even after 10 minues
• BZ - 1930789 - pulp3: creating repo with background Download Policy fails
• BZ - 1930814 - pulp3: Exclude filter in CVV does not work
• BZ - 1931527 - Role and Usage type form labels reversed in systempurpose bulk actions UI
• BZ - 1931830 - [RFE] Need to add deprecation warning on Content Host -> Register Content Host page since we are planning to deprecate katello-ca-consumer and old registration method.
• BZ - 1932013 - pulp3: Attempting to sync a repo which has no "updated date" in metadata fails
• BZ - 1933078 - Remove Beta from version on login page before GA
• BZ - 1933187 - pulp3: upgrade python-productmd to 1.31
• BZ - 1933201 - EUS/AUS/ELS content set constraints for satellite-tools-6.9 are missing from cdn/cs_mappings
• BZ - 1933770 - pulp2: Syncing container content to the external Capsule fails
• BZ - 1934105 - Remote execution terminal limited to 200px height
• BZ - 1934114 - insights-client data upload fails on Satellite client
• BZ - 1934190 - Configure Cloud Connector doesn't work when non-default organization is selected
• BZ - 1934209 - pulp3: Make migration no-op if there are no changes in plan and everything is migrated
• BZ - 1934258 - pulp3: migration: Attempting to sync a migrated repo which has URL with no trailing slash fails
• BZ - 1934671 - pulp3 HTB: Actions::Pulp3::Repository::DeleteVersion (Can't delete version of Content View)
• BZ - 1935093 - Subscriptions to Satellite are randomly lost
• BZ - 1935760 - pulp3: typo in foreman-rake katello:approve_corrupted_migration_content suggests incorrectly named task unapprove_corrupted_migration_content
• BZ - 1935786 - Satellite 6.8 upgrade fails with error "Validation failed: Lookup values is invalid" at db:migrate stage
• BZ - 1936468 - Check APIv3 is supported and marked as deprecated
• BZ - 1936862 - Filter inventory query only to hosts that belong to the current Satellite
• BZ - 1936873 - Synchronize tags published by inisghts-client and rh_cloud reports.
• BZ - 1936878 - Filter out hits for unauthorized hosts
• BZ - 1937072 - Errata is missing for a content host after pulp3 migration+switchover
• BZ - 1937123 - Pulp 2.21.5 included out of order migrations
• BZ - 1937403 - Pulp3 migration reports failed services
• BZ - 1937534 - pulp3: running with pulp3 on has race condition during sync that could cause applicable errata for a host to be empty or incorrect
• BZ - 1939090 - "Erratum record has migrated_pulp3_href NULL value" error message when running pulp_3_content_switchover
• BZ - 1939558 - pulp3: katello content switchover rake task uses a sync task instead of an async task
• BZ - 1939834 - 400 BadRequest from the server on registering host to insights.
• BZ - 1939944 - all requests are logged as coming from 127.0.0.1 in production.log
• BZ - 1940188 - Hanging task when restarting services during pulp2 to pulp3 migration
• BZ - 1940657 - pulp3: Running migration can sometimes hit the "HTTP status code: 502" Error
• BZ - 1940678 - pulp3: excess memory consumption when importing errata during pulp3 migration
• BZ - 1949186 - need updated rubygem-rake

CVEs

• CVE-2015-1820
• CVE-2015-3448
• CVE-2017-2662
• CVE-2018-1000119
• CVE-2019-16782
• CVE-2019-18874
• CVE-2020-8162
• CVE-2020-8164
• CVE-2020-8165
• CVE-2020-8166
• CVE-2020-8167
• CVE-2020-8185
• CVE-2020-9402
• CVE-2020-11612
• CVE-2020-14335
• CVE-2020-15169
• CVE-2020-25633

References

• https://access.redhat.com/security/updates/classification/#moderate