(RHSA-2016:2839) Important: CFME 5.6.3 security, bug fix, and enhancement update

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.

Security Fix(es):

• A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as. (CVE-2016-5402)

This issue was discovered by Simon Lukasik (Red Hat).

Additional Changes:

This update also fixes various bugs and adds several enhancements. Notable changes include:

Changes to the Automate component:

• This release of CloudForms allows provisioning of a virtual machine without specifying a host but validating a cluster. CloudForms now validates if either a host or cluster is selected when provisioning on VMware. (BZ#1378116)

Changes to the Providers component:

• In the previous version of CloudForms, when attempting to open a VNC console to an instance, CloudForms failed to connect because the instance did not exist for that tenant - it attempted to use the wrong tenant. This update specifies the tenant when opening a VNC console which has resolved the issue. CloudForms is now able to connect successfully without an error. (BZ#1370207)

Changes to the Provisioning component:

• In the previous version of CloudForms, cloning a VMware template failed when the target datacenter was nested below multiple folders. This was because if the datacenter was nested logically under various folders, users were unable to find the placement ID during an autoplacement VMware provision request. This fix always does a lookup of the folder path from the host datacenter instead of statically setting a possible wrong default value which has resolved the issue. (BZ#1361174)

Changes to the Replication component:

• In the previous version of CloudForms, subscription validation failed for replication subscriptions which were successfully saved. This was because the validation was done directly by the UI which did not have access to passwords of currently saved subscriptions. The validation would pass when the user enters the password when initially saving the subscription, but failed once the subscription needed to be retrieved from the database. This update has fixed the failing validation on saved replication subscriptions. (BZ#1378554)

Changes to the vulnerability component:

• A code injection flaw was found in the way capacity and utilization imported control files are processed. A remote, authenticated attacker with access to the capacity and utilization feature could use this flaw to execute arbitrary code as the user CFME runs as. (BZ#1357559)

• In the previous version of CloudForms, when trying to save filters in Subnets/Routers/Security groups/Floating IPs/Network ports exception appeared. This was caused due to missing routes for network resources. This update adds missing routes for network resources and the issue has now been resolved. (BZ#1370573)

• In the previous version of CloudForms, My Filters in datastore was unclickable and no filters were shown under it. This update enabled My Filters in datastore and the issue is now resolved. (BZ#1379727)