RHSA-2023:6818 - Security Advisory

Topic

An update is now available for Red Hat Satellite 6.14. The release contains a
new version of Satellite and important security fixes for various components.

Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Red Hat Satellite is a systems management tool for Linux-based
infrastructure. It allows for provisioning, remote management, and
monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

• golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487) (CVE-2023-39325)
• HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack) (CVE-2023-44487)
• GitPython: Insecure non-multi options in clone and clone_from is not blocked (CVE-2023-40267)
• kubeclient: kubeconfig parsing error can lead to MITM attacks (CVE-2022-0759)
• foreman: OS command injection via ct_command and fcct_command (CVE-2022-3874)
• ruby-git: code injection vulnerability (CVE-2022-46648)
• ruby-git: code injection vulnerability (CVE-2022-47318)
• Foreman: Arbitrary code execution through templates (CVE-2023-0118)
• rubygem-activerecord: SQL Injection (CVE-2023-22794)
• openssl: c_rehash script allows command injection (CVE-2022-1292)
• openssl: the c_rehash script allows command injection (CVE-2022-2068)
• Pulp:Tokens stored in plaintext (CVE-2022-3644)
• satellite: Blind SSRF via Referer header (CVE-2022-4130)
• python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server (CVE-2022-40899)
• golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests (CVE-2022-41717)
• rubygem-activerecord: Denial of Service (CVE-2022-44566)
• rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44570)
• rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44571)
• rubygem-rack: denial of service in Content-Disposition parsing (CVE-2022-44572)
• Foreman: Stored cross-site scripting in host tab (CVE-2023-0119)
• puppet: Puppet Server ReDoS (CVE-2023-1894)
• rubygem-actionpack: Denial of Service in Action Dispatch (CVE-2023-22792)
• rubygem-actionpack: Denial of Service in Action Dispatch (CVE-2023-22795)
• rubygem-activesupport: Regular Expression Denial of Service (CVE-2023-22796)
• rubygem-globalid: ReDoS vulnerability (CVE-2023-22799)
• rubygem-rack: Denial of service in Multipart MIME parsing (CVE-2023-27530)
• rubygem-rack: denial of service in header parsing (CVE-2023-27539)
• golang: net/http: insufficient sanitization of Host header (CVE-2023-29406)
• sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service) (CVE-2023-30608)
• python-django: Potential bypass of validation when uploading multiple files using one form field (CVE-2023-31047)
• python-requests: Unintended leak of Proxy-Authorization header (CVE-2023-32681)
• python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator (CVE-2023-36053)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For detailed instructions how to apply this update, refer to:

https://access.redhat.com/documentation/en-us/red_hat_satellite/6.14/html/upgrading_red_hat_satellite_to_6.14/index

Affected Products

• Red Hat Satellite 6.14 x86_64
• Red Hat Satellite Capsule 6.14 x86_64
• Red Hat Enterprise Linux for x86_64 8 x86_64

Fixes

• BZ - 1265120 - [RFE] Improve custom products workflow when using SCA
• BZ - 1726504 - [RFE] "Installable Errata" in report template
• BZ - 1735722 - [RFE] Removing a host from satellite WebUI should remove a host from cloud.redhat.com Inventory of insights.
• BZ - 1813953 - [RFE] Free IPs Suggested are often already used in Infoblox records
• BZ - 1859112 - Error 500 returned when token expired while provisioning a Content Host
• BZ - 1872414 - katello_content_view_filter is missing filter_type modulemd
• BZ - 1885552 - Incremental backup can not handle device minor number changes made by lvm after reboot
• BZ - 1904201 - [RFE] While publishing content view it should notify user if no new updates available in the repositories.
• BZ - 1922972 - [RFE] Content View's version should have an indication/message if a specific version has Content View Filters applied
• BZ - 1925532 - Do not require RPM puppet-foreman_scap_client that is injecting Puppet Facts
• BZ - 1944710 - Should not be able to assign LE on the client profile which is not synced on the capsule server
• BZ - 1947095 - satellite-maintain logs with DEBUG level by default
• BZ - 1949960 - Error when invalid syntax is used in search field
• BZ - 1950836 - [RFE] Generate Alerts if a tasks are in running/Paused state for more than a certain days.
• BZ - 1955046 - When editing a host group, changing the life cycle environment automatically unsets the Media and Partition Table fields under the Operating System tab
• BZ - 1967030 - [RFE] Setting up Custom Crons which implies the ability to determine a cadence for specific day of week/month.
• BZ - 1972308 - socket facts chart fails to render completely
• BZ - 1980277 - puppet-agent systemd unit not waiting for network-online.target
• BZ - 1992283 - [RFE] In Satellite WebUI -> Hosts -> Register Host page, the mandatory fields mentioned within Advanced tab should be moved to General tab
• BZ - 1995783 - foreman.service does not get enabled after running foreman-maintain service enable
• BZ - 2000215 - Year missing from dates in column "Updated" at Content -> Errata
• BZ - 2002202 - Search box in the Partition Tables page throws an Rails error
• BZ - 2009069 - Repository not displayed in container image tag's details page
• BZ - 2013759 - Password to git is visible in export summary
• BZ - 2043089 - Orphan cleanup runs fine but does not clears anything from /var/lib/pulp/media/artifact of Red Hat Capsule 6.10
• BZ - 2044537 - [ ALL_LANG] [SAT_6.8|6.9|6.10|6.11] Strings are not marked as translatable strings, Hosts - Sync Templates
• BZ - 2053421 - Installer --reset-data fails on an external DB setup
• BZ - 2055790 - satellite-maintain service enable fails to enable all services previously disabled by satellite-maintain service disable
• BZ - 2058404 - CVE-2022-0759 kubeclient: kubeconfig parsing error can lead to MITM attacks
• BZ - 2060613 - Dates specified in search queries don't respect current user time zone
• BZ - 2069324 - No inheritance of CV and LCE while selecting host group for Discovered hosts.
• BZ - 2069666 - Passing invalid value to infrasturcture_facet search key leads to PG::InvalidTextRepresentation error
• BZ - 2073535 - satellite-maintain packages check-update fails when there are no packages to be updated.
• BZ - 2077081 - Satellite LDAP Authentication with AD does not allow bind password over 60 characters
• BZ - 2077633 - [RFE] EFI support foreman-bootdisk per-host image
• BZ - 2080386 - [RFE] Hosts should upload package profile after content view / lifecycle environment change
• BZ - 2081494 - CVE-2022-1292 openssl: c_rehash script allows command injection
• BZ - 2081777 - [RFE] Support the --local-files oscap argument
• BZ - 2082001 - hammer does not give information about a label with bad format
• BZ - 2088559 - [RFE] Prevent repositories that are protected by client certificates from appearing in the list of available repositories at /pulp/content.
• BZ - 2090620 - Http proxy url text overflows in next row.
• BZ - 2094301 - Provisioning Templates on RH Satellite 6.9 and 6.10 does not install and enable Chronyd by default on RHEL 7 provisioned systems
• BZ - 2096942 - Incorrect breadcrumb text in puppet environment
• BZ - 2097310 - CVE-2022-2068 openssl: the c_rehash script allows command injection
• BZ - 2103424 - The "pulp_docker_registry_port" settings is still exposed and set to port 5000 in Satellite 6.11
• BZ - 2105676 - [RFE] Add some metadata to kickstart files
• BZ - 2106473 - [RFE] Satellite 6.10 giving traceback while importing content when manifest having no subscription
• BZ - 2116369 - Unable to enable callback plugin per-template
• BZ - 2117760 - Incremental update of the content view takes long time to complete
• BZ - 2122872 - pulpcore-api gunicorn process consumes high memory
• BZ - 2123306 - Curl command to register host is generated even without specifying the Location though Location field is marked as mandatory
• BZ - 2124658 - New UI shows creator of host as the 'Host owner' not who actually created
• BZ - 2125366 - Capsule sync fails with Error: It is not possible to add more than one advisory with the same id to a repository version
• BZ - 2127134 - The default "Katello Sync" webhook template has @object.task.action_output defined which is not a valid safemode method in Satellite 6.12
• BZ - 2129432 - [RFE] hammer recurring-logic list should display 'Action', 'Last Occurrence' and 'Next Occurrence' field which can be seen on Satellite web UI.
• BZ - 2130173 - Configure Cloud Connector runs against an old hostname after a hostname change
• BZ - 2130871 - Settings states Foreman instead of Satellite in some entries
• BZ - 2131990 - CVE-2022-3644 Pulp:Tokens stored in plaintext
• BZ - 2134436 - [RFE] Let Apache adhere to system crypto policies
• BZ - 2135215 - [RFE] Ignoring malformed treeinfo files including incorrect web server replies
• BZ - 2135498 - Expose puma worker_timeout configuration option
• BZ - 2135722 - While scheduling Remote execution job using hammer cli, the job scheduled actually runs at UTC time instead of server's own timezone.
• BZ - 2138172 - Unable to disable import_only flag in Satellite UI when set on Content Views
• BZ - 2140577 - CVE-2022-3874 foreman: OS command injection via ct_command and fcct_command
• BZ - 2140636 - Search in new host details is defaulting to first suggestion
• BZ - 2143051 - edit_organization permissions needed on upstream satellite
• BZ - 2143290 - Canceling of Reclaim space task stuck
• BZ - 2145254 - CVE-2022-4130 satellite: Blind SSRF via Referer header
• BZ - 2152951 - "Capsule Upgrade Playbook" job template is now "Smart Proxy Upgrade Playbook"
• BZ - 2154917 - foreman-maintain restart does not always ensure all services are started
• BZ - 2156522 - Misleading job status in the new host UI when running jobs in bulk
• BZ - 2158510 - [RFE] Job review details should contain scheduling information
• BZ - 2158526 - Future execution corner case can bypass input validation in the new rex wizard
• BZ - 2158702 - Satellite users with access to Virt-who Configurations can read out the 'Hypervisor Password ' from the input field
• BZ - 2158780 - minor issues in rex UI
• BZ - 2159104 - CVE-2023-0119 Foreman: Stored cross-site scripting in host tab
• BZ - 2159105 - Remove deprecated & not working API endpoints from APIdoc
• BZ - 2159291 - CVE-2023-0118 Foreman: Arbitrary code execution through templates
• BZ - 2159672 - CVE-2022-47318 ruby-git: code injection vulnerability
• BZ - 2159839 - when creating a backup on rhel7 and restoring on rhel8, the restore process will fail with permission issues
• BZ - 2161209 - hammer- allow user to run Verify Content Checksum, on container repositories.
• BZ - 2161274 - CVE-2022-41717 golang: net/http: excessive memory growth in a Go server accepting HTTP/2 requests
• BZ - 2161993 - wrong metadata if uploaded rpm have different name than name in rpm
• BZ - 2164359 - Add time_to_pickup to hammer and apidoc
• BZ - 2164400 - [RFE] Add functionality in API (to match Hammer) to Add/Delete a single Ansible role to Hostgroup without defining every role.
• BZ - 2164714 - CVE-2022-44571 rubygem-rack: denial of service in Content-Disposition parsing
• BZ - 2164719 - CVE-2022-44570 rubygem-rack: denial of service in Content-Disposition parsing
• BZ - 2164722 - CVE-2022-44572 rubygem-rack: denial of service in Content-Disposition parsing
• BZ - 2164730 - CVE-2023-22799 rubygem-globalid: ReDoS vulnerability
• BZ - 2164736 - CVE-2023-22796 rubygem-activesupport: Regular Expression Denial of Service
• BZ - 2164785 - CVE-2023-22794 rubygem-activerecord: SQL Injection
• BZ - 2164789 - CVE-2022-44566 rubygem-activerecord: Denial of Service
• BZ - 2164799 - CVE-2023-22795 rubygem-actionpack: Denial of Service in Action Dispatch
• BZ - 2164800 - CVE-2023-22792 rubygem-actionpack: Denial of Service in Action Dispatch
• BZ - 2165107 - Unclear error message with empty --certs-state
• BZ - 2165866 - CVE-2022-40899 python-future: remote attackers can cause denial of service via crafted Set-Cookie header from malicious web server
• BZ - 2165906 - inconsistent metadata expiration times cause patch jobs to return no updates available
• BZ - 2166404 - [RFE] Mention the list of possible providers in "explain_proxy_selection" rake task of Satellite 6.13
• BZ - 2166435 - Exporting repositories that have architecture restrictions results in bogus data that can't be properly imported
• BZ - 2166466 - Unable to see all ansible roles available when editing a hostgroup and the "entries per page" is bigger than the number of available roles
• BZ - 2166640 - [RFE] Customize the Host - Applied Errata report template to include the Erratum release date
• BZ - 2167097 - Job template "change content source" fails to change the content source
• BZ - 2167146 - The "Export" button in "All Hosts" page does not exports the visible columns as expected
• BZ - 2167371 - "Host - compare content hosts packages" report template should restrict or notify if Host 1* and Host 2* name are same
• BZ - 2167396 - job invocation shows wrong info after remote execution job (regression from 6.11)
• BZ - 2168414 - The customer can't see the .686 errata package to be installed via webUI. However, in the CH, they can see both version getting updated
• BZ - 2169322 - Reclaim space for repository fails with Cannot delete some instances of model 'Artifact' because they are referenced through protected foreign keys: 'ContentArtifact.artifact'."
• BZ - 2169385 - CVE-2022-46648 ruby-git: code injection vulnerability
• BZ - 2169682 - [Sat6.12/Installer/Bug] ansible collection sat6 operations created file rhcd.service.d/proxy.conf has permissions warning
• BZ - 2169847 - Navigating to Capsules page on Satellite WebUI displays error "Pulp plugin missing for synchronizable content types: . Repositories containing these content types will not be synced." for few seconds
• BZ - 2170125 - Missing repository name (image name) in Container tags CVv comparison
• BZ - 2170127 - Hidden CV version number in CVv comparison
• BZ - 2170485 - Importing Red Hat Repository Import on Disconnected Red Hat Satellite taking huge time around 5 hours
• BZ - 2170535 - Yet another deadlock during Capsule sync, now when existing content changed
• BZ - 2170917 - Can't update the redhat_repository_url without changing the cdn_configuration to custom_cdn
• BZ - 2171180 - Reasons for not deleting the manifest don't apply with SCA enabled
• BZ - 2172355 - Content view publish with filters is getting failed with error "Could not find the following content units:"
• BZ - 2172564 - Incremental syncable content export of a file repo is not incremental
• BZ - 2173159 - Error logged in production.log while viewing the job invocation
• BZ - 2173199 - Can't generate a full bootdisk when using installation media hosted on https URL
• BZ - 2173535 - External capsule is auto-synced on CV promotion regardless foreman_proxy_content_auto_sync settings
• BZ - 2173671 - [Pulp-3] Repair API cannot fix\re-download the docker repo content completely
• BZ - 2173692 - [Pulp-3] The Repair API fails to perform any further repair if it has encountered errors while processning any docker manifest
• BZ - 2173757 - Can't rerun a failed content-import task if it was exported using chunks
• BZ - 2174367 - Improve the documentation for redhat.satellite.setting module from Satellite Ansible collections
• BZ - 2174912 - [RFE] add ability to skip syncing .treeinfo files
• BZ - 2176214 - 'System purpose' modal doesn't reset after switching hosts with switcher
• BZ - 2176368 - undefined method `[]' for nil:NilClass" or undefined method `last' for nil:NilClass" when generating Host - applied errata report
• BZ - 2176477 - CVE-2023-27530 rubygem-rack: Denial of service in Multipart MIME parsing
• BZ - 2176870 - Custom repo sync failed " Cannot open /var/lib/pulp/tmp/89726@satellite.example.com/tmpzmdau7qg/tmpy_kkhu3a: Cannot detect compression type"
• BZ - 2178133 - Need static ouia-ids for the sub-tabs on host details page
• BZ - 2178176 - Satellite showing errata from module streams not installed on client as upgradable/installable when content is imported (not synced)
• BZ - 2178307 - Support satellite-clone with Ansible running on Python 3.11 in RHEL 8.8
• BZ - 2178645 - Error importing repositories with GPG key
• BZ - 2178734 - sudo should not be needed when migrating the pulp database script migrate.rb
• BZ - 2178775 - ACS page shows loading spinner forever after bulk removing ACSs
• BZ - 2179574 - Bash Completion For Satellite-Maintain Command does not work
• BZ - 2179649 - CVE-2023-27539 rubygem-rack: denial of service in header parsing
• BZ - 2179721 - message should be display correct when create virt-who configuration
• BZ - 2179725 - message should be display correct when Edit virt-who configuration
• BZ - 2180490 - Package grub2-efi-x64 is only installed when tftp feature is enabled
• BZ - 2180760 - no way to test-fire a webhook when configuring it
• BZ - 2180865 - Legacy Hosts UI loaded when you navigate from the Host's VMRC Console button
• BZ - 2180954 - Clear search link doesn't work in any tables except maybe Host details
• BZ - 2181226 - Host Detail button landed to old Host UI page
• BZ - 2181254 - Add support of in-toto mediaType
• BZ - 2181602 - "undefined method `event' for nil:NilClass" in production.log when trying to remediate insights issues from CRC.
• BZ - 2182353 - Rex wizard select menus should append to the parent container
• BZ - 2183172 - Installable updates links on the hosts page still link to the old content host detail page.
• BZ - 2183357 - [Satellite 6] Ansible Satellite Collection repository (redhat.satellite.repositories) module logs credentials
• BZ - 2184278 - Bring back the option to Republish Repository\CV Version metadata from Satellite UI
• BZ - 2186713 - Getting "NoMethodError undefined method `get_status' for nil:NilClass" when publishing content view
• BZ - 2186765 - Capsule redundantly synces *-Export-Library repos
• BZ - 2187599 - Provisioning a baremetal physical machine using Full Host Image is failing on Red Hat Satellite 6.12 with the error - "error:/../../grub-core.script/lexer.c:352:syntax error".
• BZ - 2187613 - changed Smart Class Parameters documentation link
• BZ - 2187903 - CVE-2023-30608 sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service)
• BZ - 2187967 - API and WebUI provides different results for Hostgroup Ansible roles association
• BZ - 2188504 - The "hammer export" command using single thread encryption causes a performance bottleneck.
• BZ - 2188721 - hammer content import fails with undefined method `substitutor' for nil:NilClass during import content if product being imported is not covered by subscriptions on the manifest
• BZ - 2192565 - CVE-2023-31047 python-django: Potential bypass of validation when uploading multiple files using one form field
• BZ - 2192583 - "Add parameter" button's data-ouia-component-id is changing
• BZ - 2192841 - foreman-protector plugin should not lock packages for reposync
• BZ - 2193088 - CVE-2023-1894 puppet: Puppet Server ReDoS
• BZ - 2193451 - Insights data not showing up in Satellite
• BZ - 2196076 - Target hosts within Remote Execution job page are zero when job is being executed on large number of hosts by selecting all machines listed within "All Hosts" page.
• BZ - 2196085 - Publishing new version of content view after Satellite 6.12 to 6.13 upgrade fails with error "Orphaned content facets for deleted hosts exist for the content view and environment. Please run rake task : katello:clean_orphaned_facets and try again!
• BZ - 2196436 - Can't query plugin CRs via GraphQL
• BZ - 2196540 - "Host-Registered Content Hosts" Report gives error while generating - undefined method `nvra' for nil:NilClass
• BZ - 2196775 - fatal NoMethodError and TypeError when hitting the API during startup
• BZ - 2203093 - Edit interfaces link changes its data-ouia-component-id
• BZ - 2203183 - [RFE] QoL improvements to the new Run job wizard
• BZ - 2207782 - Ansible Variables Documentation link results in a 404
• BZ - 2208161 - Incorrect aria-label in the alternate content source details
• BZ - 2208535 - Prevent regenerating metadata for repositories that use complete mirroring
• BZ - 2209037 - Host details UI, Repository sets table contains empty column header
• BZ - 2209469 - CVE-2023-32681 python-requests: Unintended leak of Proxy-Authorization header
• BZ - 2209938 - Incorrect aria-label in the alternate content source drawer
• BZ - 2210284 - Satellite throws error undefined method `html_safe' for nil:NilClass when trying to access some remote execution features
• BZ - 2210297 - tasks Actions::Katello::BulkAgentAction without any sub-plans and stuck in running/pending
• BZ - 2211210 - Red Hat supported provisioning templates are not recognized by RH icon on the row for a given template
• BZ - 2211394 - Unable to use Satellite\Foreman ansible modules to create compute_profiles when the Cluster is nested inside a folder under the datacenter of VMware vCenter
• BZ - 2211437 - Hammer host update command return status 70, Internal server error
• BZ - 2211484 - Global Registration using an user with "Register Hosts" role ignores all the setup options.
• BZ - 2211502 - During upgrade, services are unnecessarily down while packages are being downloaded
• BZ - 2211711 - Arch restriction label missing from Repository sets for repos without URL
• BZ - 2211966 - "TypeError: string.split is not a function" when accessing ansible variables on a host
• BZ - 2212148 - Branding scripts aren't loaded in time
• BZ - 2212523 - Content-export incremental with syncable format based does not include productid file into repodata directory
• BZ - 2212630 - Virtual machine goes in re-provisioning mode while registration host using Global registration template.
• BZ - 2212740 - Incorrect aria-label and component id in the alternate content source modal for editing credentials
• BZ - 2212756 - Link for container count on CV page redirects to an invalid page
• BZ - 2212812 - Incorrect aria-label and component id in the alternate content source modal for editing credentials certificates
• BZ - 2212996 - snapshot backup/restore broken
• BZ - 2213088 - ID for activation keys on register host page is incorrect
• BZ - 2213128 - Unable to enable any repository in network sync
• BZ - 2213190 - Incorrect aria-label and component id in the alternate content source modal for editing smart proxies
• BZ - 2213246 - Bump recommended Red Hat repos for 6.14
• BZ - 2213281 - Environment and Content View info is not visible on the Associations Content Host page for Activation keys
• BZ - 2213486 - Incorrect aria-label and component id in the alternate content source modal for editing Products
• BZ - 2213515 - Upgrade to 6.14 fails on rpm.0048_artifacts_dependencies_fix migration with TypeError: 'NoneType' object is not subscriptable
• BZ - 2213579 - "NoMethodError: undefined method `lifecycle_environment'" when performing inventory upload.
• BZ - 2213582 - satellite and satellite-capsule rpms contains stream release
• BZ - 2213768 - Upstream name `Smart Proxies` is shown instead of the downstream name `Capsules` in WebUI
• BZ - 2213777 - Can't remove GPG and SSL Keys from existing Product using the API
• BZ - 2213804 - Editing a host results in an error "content_view_id and lifecycle_environment_id must be provided together"
• BZ - 2214261 - rex wizard should hint that it provides extended cronline expressions
• BZ - 2214272 - Non admin user with view-hosts permission leads to broken error page
• BZ - 2214274 - Non-admin user with view-hosts permission has the capability to click on add parameter button
• BZ - 2214290 - Assigning scap policy to a user with only view-hosts permission leads to rendering of page in loop
• BZ - 2214578 - Can't add hostgroup to new host
• BZ - 2215081 - undefined method `content_view=' for #<Katello::Host::ContentFacet:0x00007fc530855ac8>
• BZ - 2215093 - Optimize DockerMetaTag query and CV version deletion to run a single invocation of the method.
• BZ - 2215238 - Optimized capsule sync doesn't sync recently published/promoted docker repositories
• BZ - 2215294 - Hammer doesn't show LCE and CV of a host
• BZ - 2215426 - [Regression] VMware Image-based and full host boot disk based Provisioning fails with error-: Could not find virtual machine network interface matching <IP>
• BZ - 2215954 - ACS error message contains duplicate words
• BZ - 2215986 - In Downstream satellite, both "Capsule Upgrade Playbook" and "Smart Proxy Upgrade Playbook" job template are listing.
• BZ - 2216194 - Search in Settings returns Error 500 in search suggestions dropdown
• BZ - 2216461 - undefined method `each' for #<Katello::ContentViewEnvironment when running hammer host subscription register
• BZ - 2216564 - Add UI banners warning users about katello-agent removal
• BZ - 2216757 - CV page needs refresh to get the current filters state
• BZ - 2216907 - Convert2Rhel utility fails with package not found
• BZ - 2217942 - satellite 6.11 API Content View Lists same Environment Name and Label despite name changes
• BZ - 2218004 - CVE-2023-36053 python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator
• BZ - 2218307 - Upgrade rake task will create bad content overrides on post-6.14.0 Satellite upgrades
• BZ - 2218625 - Update katello-agent deprecation warnings to show specific removal version in hammer
• BZ - 2218878 - Upgrade to Satellite 6.12 can fail if some on_demand repositories have checksum_type set
• BZ - 2218930 - hammer job-invocation create --feature katello_errata_install --inputs only installs 1 errata
• BZ - 2218932 - SELinux is preventing pulpcore-worker from read access on the key labeled pulpcore_server_t
• BZ - 2219648 - Satellite Web UI >> Hosts >> All Hosts page loading slow even after power isn't selected from the new option "Manage columns".
• BZ - 2220965 - Can no longer select other options in job category other than "Command" for a normal user while scheduling Remote Jobs
• BZ - 2220969 - The "Review details" page of the "Run Job" REX wizard shows values from hidden fields
• BZ - 2220978 - Selecting day of the week for recurring remote jobs chooses wrong day
• BZ - 2221291 - Sat 6.14 is slow to sync and index repositories
• BZ - 2221407 - Satellite Capsule clamps reply to a max of 100 tags when listing the tags (break RHOSP)
• BZ - 2221621 - katello-certs-check does not cause the installer to halt execution on failure
• BZ - 2221983 - Satellite throws error undefined method `html_safe' for nil:NilClass when autoprovision/provision is initiated for a discovered host
• BZ - 2222167 - CVE-2023-29406 golang: net/http: insufficient sanitization of Host header
• BZ - 2222444 - Content view dependency solving should be tracked for needs_publish
• BZ - 2222446 - hammer content-view version info --include-applied-filters true should display rules
• BZ - 2222447 - Hammer should treat indeterminate needs_publish as publish_needed.
• BZ - 2222705 - "Applicable errata" and "registered content hosts" reports syntax highlighting broken + applicable errata name needs changing
• BZ - 2222839 - libvirt Hypervisor Server and Hypervisor Username miss on create virt-who configuration UI
• BZ - 2222890 - update event is not created after updating CV name
• BZ - 2222907 - Upgrade to 6.14 fails on rpm.0049_profiles_fix migration with TypeError: 'NoneType' object is not subscriptable
• BZ - 2222979 - Repository details page shouldn't say 'enabled by default'
• BZ - 2223048 - Enabling Red Hat Common repository is not required while installing Satellite 6.14 on a virtual machine hosted on Red Hat Virtualization
• BZ - 2223050 - The Documentation within "Inventory Upload" in Satellite WebUI redirects to a page which says "This page could not be found"
• BZ - 2223618 - Change host content source warning implies overall failure when it should instead tell you that step 1 of 2 is complete
• BZ - 2223707 - Capsule docker sync fails with 406
• BZ - 2223891 - ERF42-4237 [Foreman::Exception]: Unknown input command for template Install Package - Katello Script Default, while customizing remote exucution job.
• BZ - 2223996 - e-mail notification for long running tasks contains untranslated localization strings
• BZ - 2224031 - Repository sync failed with error "ERROR: insert or update on table "katello_repository_rpms"
• BZ - 2224113 - ACS bulk refresh through API silently sanitizes input ids
• BZ - 2224334 - The Documentation within "Policies" in Satellite Web UI redirects to old URL.
• BZ - 2224494 - The "IPv4 Subnet" field is not showing subnets while selecting the "Domain" in a Hostgroup
• BZ - 2224498 - "Synced Media" selection is not happening even after selecting the Right CV\LCE\ContentSource\Arch\OS in Hosts or Hostgroups
• BZ - 2225090 - Re-running apply errata remote execution task fails with error Validation failed: Template install errata - katello script default:.
• BZ - 2225141 - Enablement of foreman-plugin-kubevirt fails because of missing rubygem-jsonpath package
• BZ - 2225333 - Blank Screen is displayed while opening the web console of registered client host via Satellite WebUI
• BZ - 2225383 - "hammer scap-content create" failing due to SCAP contents are not present on satellite
• BZ - 2225402 - Associating a host with an VM with added "Precision Clock Device" on Satellite fails with error unknown VMODL type VirtualPrecisionClock
• BZ - 2225406 - Can not re-register with --force after deleting consumer certs against satellite614
• BZ - 2225409 - Capsule autosync settings requires service restart to take effect
• BZ - 2226950 - Size of a "Complete Library export" can be double the consumption of /var/lib/pulp/media/artifact/
• BZ - 2227028 - re-synchronizing the repository whose sync had failed earlier, the Content View does not display new upgradable packages that are available.
• BZ - 2227093 - Task queue can be overloaded with import tasks to the exclusion of other work
• BZ - 2227271 - [Regression] The "hammer content-view version republish-repositories" action is not republishing repository metadata for the content-view versions in Satellite 6.14
• BZ - 2227338 - Change content source page never shows job invocation link
• BZ - 2228287 - Puppet config group edit page breaks with "undefined method "environment' for #?ForemanPuppet:ConfigGroup:0x0000555d6a93b90"
• BZ - 2229788 - Memory Leak occurs when making repeated large queries against Pulpcore API service
• BZ - 2229897 - Remediation from CRC via Satellite shows "Failed" status even after successful remediation of Insights recommendations.
• BZ - 2230584 - Relax pulpcore api_service_worker_max_requests
• BZ - 2230934 - restore of offline incremental backups is broken
• BZ - 2231363 - Media and Partition table fields doesn't get populated from operating-system while creating host with UI when Puppet is enabled
• BZ - 2231474 - CVE-2023-40267 GitPython: Insecure non-multi options in clone and clone_from is not blocked
• BZ - 2232370 - undefined method '#single_content_view' for Katello::Host::ContentFacet::Jail (Katello::Host::ContentFacet) (Safemode::NoMethodError)
• BZ - 2232775 - Unable to edit content view assignment in Satellite WebUI non-legacy view due to LCEs taking up space.
• BZ - 2234444 - redhat.satellite.content_view_publish role does not include option for adding additional comment and option for automatic promote to environments
• BZ - 2235231 - Discovery Provisioning fails as the sync media is getting diminished from the host page even though its synced.
• BZ - 2236685 - Satellite Operations Collection contains wrong content
• BZ - 2239115 - FDI package is not updated in 6.14.0
• BZ - 2242803 - CVE-2023-44487 HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)
• BZ - 2243296 - CVE-2023-39325 golang: net/http, x/net/http2: rapid stream resets can cause excessive work (CVE-2023-44487)
• BZ - 2245056 - Long running task watching can trigger itself under certain scenarios
• BZ - 2245930 - Capsule slowdown from 10 minutes to 2 hours

CVEs

• CVE-2022-0759
• CVE-2022-1292
• CVE-2022-2068
• CVE-2022-3644
• CVE-2022-3874
• CVE-2022-4130
• CVE-2022-40899
• CVE-2022-41717
• CVE-2022-44566
• CVE-2022-44570
• CVE-2022-44571
• CVE-2022-44572
• CVE-2022-46648
• CVE-2022-47318
• CVE-2023-0118
• CVE-2023-0119
• CVE-2023-1894
• CVE-2023-22792
• CVE-2023-22794
• CVE-2023-22795
• CVE-2023-22796
• CVE-2023-22799
• CVE-2023-27530
• CVE-2023-27539
• CVE-2023-29406
• CVE-2023-30608
• CVE-2023-31047
• CVE-2023-32681
• CVE-2023-36053
• CVE-2023-39325
• CVE-2023-40267
• CVE-2023-44487

References

• https://access.redhat.com/security/updates/classification/#important
• https://access.redhat.com/security/vulnerabilities/RHSB-2023-003