(RHSA-2017:1601) Important: CFME 5.7.3 security, bug fix and enhancement update

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.

rh-ruby23-rubygem-nokogiri provides Nokogiri, which is an HTML, XML, SAX,
and Reader parser. Among Nokogiri’s many features is the ability to search
documents using XPath or CSS3 selectors.

rh-ruby23-rubygem-ovirt-engine-sdk4 provides the ruby SDK for the oVirt
Engine API.

The following packages have been upgraded to a later upstream version: cfme
(5.7.3.2), cfme-gemset (5.7.3.2), rh-ruby23-rubygem-nokogiri (1.7.2), cfme-appliance (5.7.3.2), rh-ruby23-rubygem-ovirt-engine-sdk4 (4.1.5). (BZ#1442774, BZ#1459319)

This update also fixes several bugs and adds various enhancements. Documentation for these changes is available from the Technical Notes document linked to in the References section.

Security Fix(es):

• CloudForms includes a default SSL/TLS certificate for the web server.
  This certificate is replaced at install time. However if an attacker were
  able to man-in-the-middle an administrator while installing the new
  certificate, the attacker could get a copy of the uploaded private key allowing for future attacks. (CVE-2016-4457)

• The dialog for creating cloud volumes (cinder provider) in CloudForms
  does not filter cloud tenants by user. An attacker with the ability to
  create storage volumes could use this to create storage volumes for any other tenant. (CVE-2017-7497)

• A flaw was found in the CloudForms API. A user with permissions to use
  the MiqReportResults capability within the API could potentially view data
  from other tenants or groups to which they should not have access.
  (CVE-2016-7047)

The CVE-2016-4457 and CVE-2016-7047 issues were discovered by Simon Lukasik
(Red Hat) and the CVE-2017-7497 issue was discovered by Gellert Kis (Red
Hat).