Source

Synopsis

Important: Satellite 6.8 release

Type/Severity

Security Advisory: Important

Topic

An update is now available for Red Hat Satellite 6.8 for RHEL 7.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

Description

Red Hat Satellite is a systems management tool for Linux-based
infrastructure. It allows for provisioning, remote management, and
monitoring of multiple Linux deployments with a single centralized tool.

Security Fix(es):

mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258)
netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)
rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7663)
puppet: puppet server and puppetDB may leak sensitive information via metrics API (CVE-2020-7943)
jackson-databind: multiple serialization gadgets (CVE-2020-8840 CVE-2020-9546 CVE-2020-9547 CVE-2020-9548 CVE-2020-10968 CVE-2020-10969 CVE-2020-11619 CVE-2020-14061 CVE-2020-14062 CVE-2020-14195)
foreman: unauthorized cache read on RPM-based installations through local user (CVE-2020-14334)
Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover (CVE-2020-14380)
Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS (CVE-2019-12781)
rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)
rubygem-secure_headers: limited header injection when using dynamic overrides with user input (CVE-2020-5216)
rubygem-secure_headers: directive injection when using dynamic overrides with user input (CVE-2020-5217)
rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks (CVE-2020-5267)
puppet: Arbitrary catalog retrieval (CVE-2020-7942)
rubygem-rack: directory traversal in Rack::Directory (CVE-2020-8161)
rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names (CVE-2020-8184)
hibernate-validator: Improper input validation in the interpolation of constraint error messages (CVE-2020-10693)
puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL (CVE-2018-11751)

For more details about the security issue(s), including the impact, a CVSS
score, acknowledgments, and other related information, refer to the CVE
page(s) listed in the References section.

Additional Changes:

Provides the Satellite Ansible Modules that allow for full automation of your Satellite configuration and deployment.
Adds ability to install Satellite and Capsules and manage hosts in a IPv6 network environment
Ansible based Capsule Upgrade automation: Ability to centrally upgrade all of your Capsule servers with a single job execution.
Platform upgrades to Postgres 12, Ansible 2.9, Ruby on Rails and latest version of Puppet
Support for HTTP UEFI provisioning
Support for CAC card authentication with Keycloak integration
Add ability to upgrade Red Hat Enterprise Linux 7 hosts to version 8 using the LEAPP based tooling.
Support for Red Hat Enterprise Linux Traces integration
satellite-maintain & foreman-maintain are now self updating
Notifications in the UI to warn users when subscriptions are expiring.

The items above are not a complete list of changes. This update also fixes
several bugs and adds various enhancements. Documentation for these changes
is available from the Release Notes document linked to in the References
section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Red Hat Satellite 6.8 x86_64
Red Hat Satellite Capsule 6.8 x86_64

Fixes

BZ - 1160344 - [RFE] Satellite support for cname as alternate cname for satellite server
BZ - 1261802 - [RFE] Make the foreman bootdisk full-host image work on UEFI systems
BZ - 1300211 - capsule-certs-generate failed to increment release number when generating certificate rpm for foreman-proxy
BZ - 1332702 - smart-proxy-openscap-send with additional features - alert if file corrupt
BZ - 1398317 - For the vms built by Satellite 6 using "Network Based" installation mode on VMWare, unable to change the boot sequence via BIOS
BZ - 1410616 - [RFE] Prominent notification of expiring subscriptions.
BZ - 1410916 - Should only be able to add repositories you have access to
BZ - 1429033 - Host provisioned with RHEL Workstation OS, after provisioning displayed as generic RedHat 7.3
BZ - 1461781 - [RFE]A button should be available in the GUI to clear the recurring logics.
BZ - 1469267 - need updated rubygem-rake
BZ - 1486446 - Content view versions list has slow query for package count
BZ - 1486696 - 'hammer host update' removes existing host parameters
BZ - 1494180 - Sorting by network address for subnet doesn't work properly
BZ - 1501499 - tomcat listens to 0.0.0.0 for serving requests but just needs localhost
BZ - 1503037 - [RFE] Cancelled future/recurring job invocations should not get the status "failed" but rather "cancelled"
BZ - 1505842 - Remote Execution engine: Error initializing command: Net::SSH::HostKeyMismatch - fingerprint 20:a9:b7:45:1a:b7:d6:42:1e:03:d1:1f:06:20:4c:e2 does not match for "172.17.0.101"
BZ - 1531674 - Operating System Templates are ordered inconsistently in UI.
BZ - 1537320 - [RFE] Support for Capsules at 1 version lower than Satellite
BZ - 1543316 - Satellite 6.2 Upgrade Fails with error "rake aborted! NoMethodError: undefined method `first' for nil:NilClass" when there are custom bookmarks created
BZ - 1563270 - Sync status information is lost after cleaning up old tasks related to sync.
BZ - 1569324 - Webrick is unable to use 2 supported TLS v1.2 ciphers ('ECDHE-RSA-AES128-GCM-SHA256', 'ECDHE-RSA-AES256-GCM-SHA384')
BZ - 1571907 - Passenger threads throwing tracebacks on API jobs after spawning
BZ - 1576859 - [RFE] Implement automatic assigning subnets through data provided by facter
BZ - 1584184 - [RFE] The locked template is getting overridden by default
BZ - 1601101 - [RFE] Add autofill functionality to the Job invocation Search query box, copy from Hosts search box
BZ - 1607706 - [RFE] Add support for --vlanid in Satellite Kickstart Default provisioning template
BZ - 1608001 - Rearrange search/filter options on Red Hat Repositories page.
BZ - 1613391 - race condition on removing multiple organizations simultaneously
BZ - 1619274 - [RFE] Red Hat Satellite should now be able to discover and provision bare metal machines via UEFI HTTP boot
BZ - 1619422 - User Agent for Downstream RSS feed still says Foreman and Foreman Version
BZ - 1620214 - Page should auto-refresh after subscriptions have been modified on the Satellite webui
BZ - 1624049 - Changing the organization in the Satellite WebUI does not change the sync plan page information from the previous organization
BZ - 1625258 - Having empty "Allocation (GB)" when creating a new Host, nil:NilClass returned on creating the Host
BZ - 1627066 - Unable to revert to the original version of the provisioning template
BZ - 1630433 - [RFE] Include Ansible Satellite modules with Ansible Core modules
BZ - 1630536 - yum repos password stored as cleartext
BZ - 1632577 - Audit log show 'missing' for adding/removing repository to a CV
BZ - 1640615 - CVE-2018-3258 mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018)
BZ - 1645062 - host_collection controller responds with 200 instead of 201 to a POST request
BZ - 1645749 - repositories controller responds with 200 instead of 201 to a POST request
BZ - 1647216 - Lack of edit_smart_proxies permission causes error when setting host to Build
BZ - 1647364 - [RFE] Extend the audits by the http request id
BZ - 1647781 - Audits contain no data (Added foo to Missing(ID: x))
BZ - 1651297 - Very slow query when using facts on user roles as filters
BZ - 1653217 - [RFE] More evocative name for Play Ansible Roles option?
BZ - 1654347 - Satellite may create duplicate CreateRssNotifications tasks after restarting foreman tasks
BZ - 1654375 - [RFE] Mention specifically uder the admin chexbox for AD LDAP user if its created with admin role,
BZ - 1659418 - katello-tracer-upload failing with error "ImportError: No module named katello"
BZ - 1665277 - subscription manager register activation key with special character failed
BZ - 1665893 - candlepin refuses to start or hangs periodically when having too many messages in ActiveMQ journal
BZ - 1666693 - Command "hammer subscription list" is not correctly showing the comment "Guests of " in the "Type" field in the output.
BZ - 1677907 - Ansible API endpoints return 404
BZ - 1680157 - [RFE] Puppet 'package' provider type does not support selecting modularity streams
BZ - 1680458 - Locked Report Templates are getting removed.
BZ - 1680567 - Reporting Engine API to list report template per organization/location returns 404 error
BZ - 1681619 - [RFE] Disable the option to enter a MAC address after selecting a compute resource while creating new hosts through Satellite
BZ - 1685949 - [RFE] Support passing of attribute name instead of Id's in RHV workflow
BZ - 1687116 - kernel version checks should not use /lib/modules to determine running version
BZ - 1688886 - subscription-manager not attaching the right quantity per the cpu core
BZ - 1691416 - Delays when many clients upload tracer data simultaneously
BZ - 1697476 - [RFE] To be able to see the name of the provisioning template being used to build a host from the host itself
BZ - 1702434 - foreman-bootloaders-redhat-tftpboot expected file permissions in package don't match runtime permissions
BZ - 1705097 - An empty report file doesn't show any headers
BZ - 1709557 - [RFE] warn the user if they have done a select all and it includes the restart|reboot service
BZ - 1709842 - Tracer shows the machines needs rebooting even after reboot if kernel-debug is installed
BZ - 1710511 - Filter by os_minor includes unexpected values on the Satellite web UI.
BZ - 1715999 - Use Infoblox API for DNS conflict check and not system resolver
BZ - 1716423 - Nonexistent quota can be set
BZ - 1717403 - Broken breadcrumbs link to compute resource VM list on VM detail page
BZ - 1718012 - [RFE] Add a hard limit of 100 items to restrict any fact child-hash/array
BZ - 1718954 - [RFE] When the contentAccessMode is set to org_environment for an owner, we should disable auto-attach globally
BZ - 1719509 - [RFE] "hammer host list" including erratas information
BZ - 1719516 - [RFE] "hammer host-collection hosts" including erratas information
BZ - 1720725 - [RFE] Ability to override DHCP options and wait_after_restart option for race condition
BZ - 1721419 - SSH key cannot be added when FIPS enabled
BZ - 1722954 - Slow performance when running "hammer host list" with a high number of Content Hosts (15k+ for example)
BZ - 1723313 - foreman_tasks:cleanup description contain inconsistent information
BZ - 1724494 - [Capsule][smart_proxy_dynflow_core] "PID file /var/run/foreman-proxy/smart_proxy_dynflow_core.pid not readable (yet?) after start"
BZ - 1724497 - CVE-2019-12781 Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS
BZ - 1726768 - [RFE] Red Hat Satellite 6 GUI, Tasks should show Full name
BZ - 1729968 - Editing disk size of a Compute Profile for a VMware Compute Resource makes the whole Storage section disappear
BZ - 1730083 - [RFE] Add Jobs button to host detail page
BZ - 1731155 - Cloud init template missing snippet compared to Kickstart default user data
BZ - 1731229 - podman search against Red Hat Satellite 6 fails.
BZ - 1731235 - [RFE] Create Report Template to list inactive hosts
BZ - 1733241 - [RFE] hammer does not inherit parent location information
BZ - 1733650 - Satellite receives RPM1004 pulp error and 403 Forbidden http error retrieving packages from CDN
BZ - 1736809 - undefined method `split' for nil:NilClass when viewing the host info with hammer
BZ - 1737135 - Content Hosts loses subscriptions after Vmotion and auto attach is unable to assigned the subscriptions if any other subscription is already attached to the host.
BZ - 1737564 - [RFE] Support custom images on Azure
BZ - 1738548 - Parameter --openscap-proxy-id is missing in hammer host create command.
BZ - 1740943 - Increasing Ansible verbosity level does not increase the verbosity of output
BZ - 1743056 - While creating a host for a particular location, all the domains are in the pull down list, even if only one domain is selected for that location.
BZ - 1743776 - Error while deleting the content view version.
BZ - 1745516 - Multiple duplicate index entries are present in candlepin database
BZ - 1746936 - satellite6 is not using remote execution by default even after setting remote execution by default from satellite web-UI.
BZ - 1749692 - Default Rhel8 scap content does not get populated on the Satellite
BZ - 1749916 - [RFE] Satellite should support certificates with > 2048 Key size
BZ - 1751981 - Parent object properties are not propagated to Child objects in Location and Host Group
BZ - 1752880 - katello-host-tools-tracer stats paths abusively, leading to a hang or slowness of yum command
BZ - 1753551 - Traces output from Satellite GUI has mismatches with client tracer output
BZ - 1756991 - 2 inputs with same name -> uninitialized constant #<Class:0x000000000b894c38>::NonUniqueInputsError
BZ - 1757317 - [RFE] Dynflow workers extraction
BZ - 1757394 - [BUG] Non-admin users always get "Missing one of the required permissions" message while accessing their own table_preferences via Satellite 6 API
BZ - 1759160 - Rake task for cleaning up DHCP records on proxy
BZ - 1761872 - Disabled buttons are still working
BZ - 1763178 - [RFE] Unnecessary call to userhelp and therefore log entries
BZ - 1763816 - [RFE] Report which users access the API
BZ - 1766613 - Fact search bar broken and resets to only searching hostname
BZ - 1766906 - Associating more than 10 Ansible roles to a Host only sets based on the per-page setting
BZ - 1767497 - Compute Resource filter does not correctly allow Refresh Cache
BZ - 1767635 - [RFE] Enable Organization and Location to be entered not just selected
BZ - 1770366 - [RFE] Improve upgrade efficiency by moving RPM post-installation scripts to the installer.
BZ - 1770544 - Puppet run job notification do not populate "%{puppet_options}"' value
BZ - 1770777 - Changing concurrency level while executing Ansible jobs fail with NoMethodError: undefined method `[]' for nil:NilClass
BZ - 1771367 - undefined method `request_uri' when Openidc Provider Token Endpoint is none
BZ - 1771428 - Openscap documentation link on Satellite 6 webui is broke
BZ - 1771484 - Client side documentation links are not branded
BZ - 1771693 - 'Deployed on' parameter is not listed in API output
BZ - 1772381 - Incorrect example to use multiple attributes as a matcher key in the tooltip for Order
BZ - 1772517 - login with the user name as same as existing user group gives 500 ISE and wont allow user to login again
BZ - 1772544 - Use APIv4 is not the default when creating a new compute resource in ovirt
BZ - 1773298 - GET /katello/api/srpms/compare always fails with error: Missing template katello/api/v2/common/compare
BZ - 1774710 - UI: When selecting the server type in ldap authentication, "attribute mappings" fields could be populated automatically
BZ - 1778396 - exporting/importing report template process is causing a different report during the visualization (blank lines)
BZ - 1778503 - Prepended text on OS name creation
BZ - 1778681 - Some pages are missing title in html head
BZ - 1779638 - Unable to filter/search http-proxies using Organization/Location for Satellite UI.
BZ - 1781671 - While using concurrency_level in remote execution, job progress in WebUI is not being updated properly
BZ - 1782352 - [RHEL 8.1 client] All packages are not getting updated after click on "Update All Packages"
BZ - 1782426 - Viewing errata from a repository returns incorrect unfiltered results
BZ - 1783568 - [RFE] - Bulk Tracer Remediation
BZ - 1783882 - Ldap refresh failed with "Validation failed: Adding would cause a cycle!"
BZ - 1784012 - Default kickstart places log to /mnt/sysimage/root/install.post.log
BZ - 1784341 - disable CertificateRevocationListTask job in candlepin.conf by default
BZ - 1785117 - [RFE] Add functionality in foreman logging to hash-out or mark as [FILTERED] the password in /var/log/foreman-maintain/foreman-maintain.log and /var/log/foreman-installer/satellite.log file
BZ - 1785231 - Ansible Variable override to false does not gets reflected on client machine on Red Hat Satellite 6.
BZ - 1785624 - [UI] Importing templates with associate 'never' is not resulting as expected
BZ - 1785683 - Does not load datacenter when multiple compute resources are created for same VCenter
BZ - 1785902 - Ansible RunHostJob tasks failed with "Failed to initialize: NoMethodError - undefined method `[]' for nil:NilClass"
BZ - 1785940 - [RFE] Reporting template should allow host filtering based on applicable errata issue date
BZ - 1787329 - change filename in initrd live CPIO archive to fdi.iso
BZ - 1788261 - CVE-2018-11751 puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL
BZ - 1788958 - [RFE] add "elapsed time" column to export and hammer, make it filterable in WebUI
BZ - 1789006 - Smart proxy dynflow core listens on 0.0.0.0
BZ - 1789100 - CVE-2019-16782 rubygem-rack: hijack sessions by using timing attacks targeting the session id
BZ - 1789434 - Template editor not always allows refreshing of the preview pane
BZ - 1789522 - On unhealthy Satellite, dynflow_envelopes table might grow indefinitely
BZ - 1789686 - Non-admin user with enough permissions can't generate report of applicable errata
BZ - 1789815 - The "start" parameter should be mentioned inside "--compute-attributes:" in hammer_cli for Satellite 6
BZ - 1789911 - "foreman-rake katello:publish_unpublished_repositories" is referring to column which no longer exists in katello_repositories table.
BZ - 1789924 - [RFE] As user I want to see a "disabled" status for Simple Content Access (Golden Ticketed) Orgs
BZ - 1791654 - drop config_templates api endpoints and parameters
BZ - 1791656 - drop deprecated host status endpoint
BZ - 1791658 - drop reports api endpoint
BZ - 1791659 - Remove `use_puppet_default` api params
BZ - 1791663 - remove deprecated permissions api parameters
BZ - 1791665 - drop deprecated compute resource uuid parameter
BZ - 1792131 - [UI] Could not specify organization/location for users that come from keycloak
BZ - 1792135 - Not able to login again if session expired from keycloak
BZ - 1792174 - [RFE] Subscription report template
BZ - 1792304 - When generating custom report, leave output format field empty
BZ - 1792378 - [RFE] Long role names are cut off in the roles UI
BZ - 1793951 - [RFE] Display request UUID on audits page
BZ - 1794015 - When using boot disk based provisioning, sometimes foreman tries to recreate folder foreman_isos in the datastore even when the folder already exists
BZ - 1794346 - Change the label for the flashing eye icon during user impersonation
BZ - 1794641 - Sync status page's content are not being displayed properly.
BZ - 1795809 - HTML tags visible on paused task page
BZ - 1796155 - [RFE] host_collections not available in reporting engine unless safe mode disabled
BZ - 1796205 - iso upload: correctly check if upload directory exists
BZ - 1796225 - CVE-2020-7238 netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling
BZ - 1796259 - loading subscriptions page is very slow
BZ - 1796697 - Unable to list/enable EUS repositories on the RHEL clients registered in the satellite server with org_environment contentAccessMode
BZ - 1798489 - [RHSSO] - If Access Token Lifespan is set to 5 mins then the user is getting sign out instead after idle SSO timeout
BZ - 1798668 - Configure default MongoDB WiredTiger cache to be 20% of RAM in the Satellite server
BZ - 1799480 - CLI - hammer repository info shows blank sync status if the repository sync is in warning/error state.
BZ - 1800503 - In Hammer, it is not possible to set default keyboard layout for a RHEV host
BZ - 1801264 - CVE-2020-5217 rubygem-secure_headers: directive injection when using dynamic overrides with user input
BZ - 1801286 - CVE-2020-5216 rubygem-secure_headers: limited header injection when using dynamic overrides with user input
BZ - 1802529 - Repository sync in tasks page shows percentage in 17 decimal points
BZ - 1802631 - Importing Ansible variables yields NoMethodError: undefined method `map' for nil:NilClass (initialize_variables) [variables_importer.rb]
BZ - 1803846 - Red Hat Insights Risk Summary shows systems at risk while there are none
BZ - 1804496 - While performing bulk actions, unable to select all tasks under Monitor --> Tasks page.
BZ - 1804651 - Missing information about "Create Capsule" via webUI
BZ - 1805501 - CVE-2020-10693 hibernate-validator: Improper input validation in the interpolation of constraint error messages
BZ - 1805727 - Default Custom Repository download policy setting refers to old name (Default Repository download policy) in satellite 6.7
BZ - 1806713 - hypervisor checkin fails with cp_consumer_hypervisor_ukey error
BZ - 1806842 - Disabling dynflow_enable_console from setting should hide "Dynflow console" in Tasks
BZ - 1806897 - Red Hat Inventory Uploads fail with NoMethodError: undefined method `mtu'
BZ - 1807042 - [RFE] Support additional disks for VM on Azure Compute Resource
BZ - 1807321 - A non-admin users with view recurring_logics permissions are unable to list recurring logics.
BZ - 1807829 - Generated inventory file doesn't exist
BZ - 1807946 - Multiple duplicate index entries are present in foreman database
BZ - 1808843 - Satellite lists unrelated RHV storage domains using v4 API
BZ - 1810250 - Unable to delete repository - Content with ID could not be found
BZ - 1810549 - dropping packets to qdrouterd triggers a memory leak in qpid-proton 0.28.0-2 libraries used by goferd
BZ - 1810774 - Applying errata via Host Collection the errata are trying to be applied to all hosts associated with the host collection
BZ - 1811390 - Links to an errata list of a repository lack repositoryId in URI and points to generic "errata" page instead
BZ - 1812031 - Improve regenerate applicability tasks performance by querying NEVRA only data from repo_content_units
BZ - 1812858 - Satellite Inventory Plugin does not appear to make reports which match yupana's API specification
BZ - 1812904 - 'Hypervisors' task fails with 'undefined method `[]' for nil:NilClass' error
BZ - 1813005 - Prevent --tuning option to be applied in Capsule servers
BZ - 1813313 - [Tracker] Test HTTP UEFI on IPv6 (QA only tracker)
BZ - 1814095 - Applicable errata not showing up for module stream errata
BZ - 1815104 - Locked provisioning template should not be allowed to add audit comment
BZ - 1815135 - hammer does not support description for custom repositories
BZ - 1815146 - Backslash escapes when downloading a JSON-formatted report multiple times
BZ - 1815608 - Content Hosts has Access to Content View from Different Organization
BZ - 1816330 - CVE-2020-8840 jackson-databind: Lacks certain xbean-reflect/JNDI blocking
BZ - 1816332 - CVE-2020-9546 jackson-databind: Serialization gadgets in shaded-hikari-config
BZ - 1816337 - CVE-2020-9547 jackson-databind: Serialization gadgets in ibatis-sqlmap
BZ - 1816340 - CVE-2020-9548 jackson-databind: Serialization gadgets in anteros-core
BZ - 1816699 - Satellite Receptor Installer role can miss accounts under certain conditions
BZ - 1816720 - CVE-2020-7942 puppet: Arbitrary catalog retrieval
BZ - 1816853 - Report generated by Red Hat Inventory Uploads is empty.
BZ - 1817215 - Admin must be able to provide all the client ids involved inside Satellite settings.
BZ - 1817224 - Loading one org's content view when switching to a different org
BZ - 1817481 - Plugin does not set page <title>
BZ - 1817728 - Default task polling is too frequent at scale
BZ - 1817874 - After data upload from satellite UI it is not visible on cloud.redhat.com.
BZ - 1818062 - Deprecated message about katello agent being shown on content host registration page
BZ - 1818816 - Web console should open in a new tab/window
BZ - 1819145 - [RFE] Incorporate apipie-dsl to document template macros, provided as one-time generated HTML document
BZ - 1819208 - CVE-2020-10968 jackson-databind: Serialization gadgets in org.aoju.bus.proxy.provider.*.RmiProvider
BZ - 1819212 - CVE-2020-10969 jackson-databind: Serialization gadgets in javax.swing.JEditorPane
BZ - 1820193 - Deleted Global Http Proxy is still being used during repository sync.
BZ - 1820245 - reports in JSON format can't handle unicode characters
BZ - 1821182 - [Repository] - Packages are not getting synced with rpm-with-sha-512
BZ - 1821335 - Inventory plugin captures information for systems with any entitlement
BZ - 1821457 - [RFE] Capsules shouldn't update hosts' "Registered through" facts on the Satellite server in a load-balanced configuration.
BZ - 1821629 - Eager zero seems to do nothing
BZ - 1821651 - Manifest import task progress remains at 0.
BZ - 1821752 - New version of the plugin is available: 1.0.5
BZ - 1822039 - Get HTTP error when deploying the virt-who configure plugin
BZ - 1822560 - Unable to sync large openshift docker repos
BZ - 1823905 - Update distributor version to sat-6.7
BZ - 1823991 - [RFE] Add a more performant way to sort reports
BZ - 1824183 - Virtual host get counted as physical hosts on cloud.redhat.com
BZ - 1824931 - After upgrading to Satellite 6.7 the Tasks page in WebUI goes "Blank"
BZ - 1825760 - schedule inventory plugin sync failed due to 'organization_id' typecasting issue.
BZ - 1825930 - [Regression] RedHat Insights client proxying stopped working due to missing proxy
BZ - 1825978 - Manifest refresh failed with 'Katello::Errors::CandlepinError Invalid credentials.' error
BZ - 1826298 - even when I cancel ReX job, remediation still shows it as running
BZ - 1826340 - [RFE] Ability to provision a VM using Red Hat Gold BYOS images
BZ - 1826515 - [RFE] Consume Candlepin events via STOMP
BZ - 1826625 - Improve performance of externalNodes
BZ - 1826678 - New version of the plugin is available: 2.0.6
BZ - 1826734 - Tasks uses wrong controller name for bookmarks
BZ - 1826805 - CVE-2020-11619 jackson-databind: Serialization gadgets in org.springframework:spring-aop
BZ - 1827389 - Manifest import and delete calls Actions::Pulp::Repository::Refresh for non-Library repositories
BZ - 1827583 - Installing dhcp_isc and dhcp_remote_isc fails with "You cannot specify the same gem twice with different version requirements.....You specified: rsec (< 1) and rsec (>= 0)"
BZ - 1828257 - Receptor init file missing [Install] section, receptor service won't run after restart
BZ - 1828486 - CVE-2020-7943 puppet: puppet server and puppetDB may leak sensitive information via metrics API
BZ - 1828549 - Manifest Certificate Exposed by Unprivileged User
BZ - 1828682 - Create compute resource shows console error 'Cannot read property 'aDataSort' of undefined'
BZ - 1828789 - [RFE] Satellite installer should support installing the Satellite Inventory Provider by default
BZ - 1828868 - Add keep alive option in Receptor node
BZ - 1829487 - Ansible verbosity level does not work
BZ - 1829766 - undefined method `tr' for nil:NilClass when trying to get a new DHCP lease from infoblox
BZ - 1830253 - Default job templates are not locked
BZ - 1830403 - Capsule sync fails when promoting a content view to more than one lifecyle env at the same time
BZ - 1830834 - Unable to update default value of a smart class parameter (Sql query error).
BZ - 1830860 - Refactor loading regions based on subscription dynamically
BZ - 1830882 - Red Hat Satellite brand icon is missing
BZ - 1830884 - bootstrap.py script tries to yum install puppet package that is not in rhel-7-server-satellite-tools-6.7-rpms repo
BZ - 1831528 - CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks
BZ - 1833031 - Improve RH account ID fetching in cloud connector playbook
BZ - 1833035 - Add remediation bulk ack message (i.e. all hosts for a given run has finished)
BZ - 1833039 - Introduce error code to playbook_run_finished response type
BZ - 1833311 - "Failed to save: Failed to save when overriding parameters for ansible, cause: Default value is invalid" while creating scap policy with ansible deployment option.
BZ - 1834302 - --enable-foreman-plugin-rh-cloud fails: Execution of '/bin/yum -d 0 -e 0 -y install tfm-rubygem-foreman_rh_cloud' returned 1: Error: Nothing to do
BZ - 1834377 - Disable mongo FTDC
BZ - 1834866 - Missing macro for "registered_at" host subscription facet
BZ - 1834898 - Login Page background got centralized and cropped
BZ - 1835189 - Missing macro for "host_redhat_subscriptions" in host subscription facet
BZ - 1835241 - Some applicability of the consumers are not recalculated after syncing a repository
BZ - 1835882 - While executing "Configure Cloud Connector" playbook on Satellite 6.7 server it does not honour HTTP Proxy setting
BZ - 1836155 - Support follow on rails, travis and i18n work for AzureRm plugin
BZ - 1836771 - In satellite installation summary report, satellite should be mentioned instead of foreman.
BZ - 1836774 - Some foreman services failed to start (pulp_streamer)
BZ - 1836845 - "Generate at" in report template should be current date
BZ - 1837951 - "invalid Unicode Property \p: /\b\perform various actions through those proxies\b(?!-)/" warning messages appears in dynflow-sidekiq@worker-hosts-queue
BZ - 1838160 - 'Registered hosts' report does not list kernel release for rhsm clients
BZ - 1838191 - Arrow position is on left rather in the middle under "Start Time"
BZ - 1838281 - CVE-2020-8161 rubygem-rack: directory traversal in Rack::Directory
BZ - 1838917 - Repositories are not showing their available Release versions due to a low default db pool size
BZ - 1838963 - Hypervisors from Satellite, never makes their way to HBI
BZ - 1838965 - Product name link is not working on the activation keys "Repository Sets" tab.
BZ - 1839025 - Configure Cloud Connector relies on information which is no longer provided by the API
BZ - 1839649 - satellite-installer --reset returns a traceback
BZ - 1839726 - Bring tfm-rubygem-foreman_leapp to downstream builds
BZ - 1839779 - undefined local variable or method `implicit_order_column' for #<ActiveRecord::Associations::CollectionProxy> on GET request to /discovery_rules endpoint
BZ - 1839966 - New version of the plugin is available: 2.0.7
BZ - 1840166 - ERF42-4995 [Foreman::Exception]: Invalid authenticity token message displayed with traceback, If re-login the machine after session timed-out .
BZ - 1840191 - Validate parameters passed by receptor to the receptor-satellite plugin
BZ - 1840218 - ArgumentError: wrong number of arguments
BZ - 1840525 - Content host list doesn't update after the successful deletion of content host.
BZ - 1840635 - Proxy has failed to load one or more features (Realm)
BZ - 1840723 - Selected scenario is DISABLED, can not continue
BZ - 1840745 - Satellite installation failed with puppet error " No Puppet module parser is installed"
BZ - 1841098 - Failed to resolve package dependency while doing satellite upgrade.
BZ - 1841143 - Known hosts key removal may fail hard, preventing host from being provisioned
BZ - 1841573 - Clicking breadcrumb "Auth Source Ldaps" on Create LDAP Auth Source results in "The page you were looking for doesn't exist."
BZ - 1841818 - icons missing on /pub download page
BZ - 1842900 - ERROR! the role 'satellite-receptor' was not found in ...
BZ - 1842943 - ~foreman-proxy/.ssh is a symlink to /usr/com/foreman-proxy/ssh/
BZ - 1843406 - In 6.8, Receptor installation playbook's inputs are visible again
BZ - 1843561 - Report templates duplicated
BZ - 1843846 - Host - Registered Content Hosts report: "Safemode doesn't allow to access 'report_hraders' on #<Safemode::ScopeObject>"
BZ - 1843867 - Satellite-installer failed with argument error while upgrading the satellite from 6.7 to 6.8
BZ - 1843926 - satellite-change-hostname fails when running nsupdate
BZ - 1844142 - [RFE] Drop a subsription-manager fact with the satellite version
BZ - 1845112 - Installer deploys outdated version of pxegrub2 mac template to TFTP
BZ - 1845486 - [RFE] Able to select 'HTTP Proxy' during Compute Resource create for 'GCE' as similar to EC2
BZ - 1845860 - hammer org add-provisioning-template command returns Error: undefined method `[]' for nil:NilClass
BZ - 1845978 - CVE-2020-7663 rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser
BZ - 1846254 - need to restart services after enabling leapp plugin
BZ - 1846313 - Add index on locks for resource type and task id
BZ - 1846317 - undefined method `klass' for nil:NilClass
BZ - 1846421 - build pxe default do not work when more than 1 provider
BZ - 1846593 - Satellite-installer failed with error "Could not find a suitable provider for foreman_smartproxy" while doing upgrade from 6.7 to 6.8
BZ - 1847019 - Empty applicability for non-modular repos
BZ - 1847063 - Slow manifest import and/or refresh
BZ - 1847407 - load_pools macro not in list of macros
BZ - 1847645 - Allow override of Katello's DISTRIBUTOR_VERSION
BZ - 1847784 - Error updating system data on the server, see /var/log/rhsm/rhsm.log for more details.
BZ - 1847840 - Libvirt note link leads to 404
BZ - 1847871 - Combined Profile Update: ArgumentError: invalid argument: nil.
BZ - 1848291 - Download kernel/initram for kexec asynchronously
BZ - 1848535 - Unable to create a pure IPv6 host
BZ - 1848538 - Failed to resolve the packages due to tfm-runtime package dependency in fm-upgrade(6.7 to 6.8)
BZ - 1848902 - ERF42-0258 [Foreman::Exception]: <uuid> is not valid, enter id or name
BZ - 1848958 - CVE-2020-14195 jackson-databind: serialization in org.jsecurity.realm.jndi.JndiRealmFactory
BZ - 1848962 - CVE-2020-14062 jackson-databind: serialization in com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool
BZ - 1848966 - CVE-2020-14061 jackson-databind: serialization in weblogic/oracle-aqjms
BZ - 1848973 - capsule-certs-generate suggests running foreman-installer --scenario foreman-proxy-content instead of satellite-installer --scenario capsule
BZ - 1849141 - CVE-2020-8184 rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names
BZ - 1849656 - ERROR! You cannot use loops on 'import_tasks' statements. You should use 'include_tasks' instead.
BZ - 1849680 - Task progress decimal precision discrepancy between UI, CLI, and API
BZ - 1849869 - Unable to recycle the dynflow executor
BZ - 1850355 - Auth Source Role Filters are not working in Satellite 6.8
BZ - 1850536 - Can't add RHEV with APIv3 through Hammer
BZ - 1850914 - Checksum type "sha256" is not available for all units in the repository. Make sure those units have been downloaded
BZ - 1850934 - Satellite-installer failed with error "Could not evaluate: Proxy xyz..com cannot be retrieved: unknown error (response 502)"
BZ - 1851017 - Position of text cursor in ace-editor wrong and hence unable to edit templates
BZ - 1851030 - [RFE] Upgrade Ansible used from RHEL to be 2.9
BZ - 1851167 - Autoattach -> "undefined" subscription added
BZ - 1851176 - Subscriptions do not provide any repository sets
BZ - 1851952 - "candlepin_events FAIL Not running" and wont restart
BZ - 1852371 - Allow http proxy ports by default
BZ - 1852723 - Broken link for documentation on installation media page
BZ - 1852733 - Inventory upload documentation redirects to default location
BZ - 1852735 - New version of the plugin is available: 2.0.8
BZ - 1853076 - large capsule syncs cause slow processing of dynflow tasks/steps
BZ - 1853200 - foreman-rake-db:migrate Fails on "No indexes found on foreman_tasks_locks with the options provided"
BZ - 1853280 - Content view filter is excluding modules and Packages when published after upgrading the Satellite from 6.6 to 6.7
BZ - 1853463 - Plugin does not upload inventory - Permission denied /var/lib/foreman/red_hat_inventory/uploads/uploader.sh
BZ - 1853504 - [Regression] Hammer export-legacy Fails with Composite Content Views
BZ - 1853572 - Broken documentation link for 'RHV' in Compute Resource
BZ - 1854138 - System purpose status should show as 'disabled' when Satellite is in Simple Content Access mode.
BZ - 1854397 - Compliance reports are not being uploaded to satellite.
BZ - 1854530 - PG::NotNullViolation when syncing hosts from cloud
BZ - 1855008 - Host parameters are set after the host is created.
BZ - 1855254 - Links to documentation broken in HTTP Proxies setup
BZ - 1855348 - katello_applicability accidentally set to true at install
BZ - 1855710 - 'Ensure RPM repository is configured and enabled' task says 'FIXME'
BZ - 1856370 - Clicking on any other tab other than overview while on capsule synchronizing page, redirects to overview page.
BZ - 1856379 - Add missing VM creation tests
BZ - 1856401 - [RFE] Add module to create HTTP Proxy
BZ - 1856831 - New version of the plugin is available: 2.0.9
BZ - 1856837 - undefined method '#httpboot' for NilClass::Jail (NilClass) when creating an IPv6 only host
BZ - 1857124 - Attempting to attach a subscription to an unregistered host results in ISE 500
BZ - 1857146 - Unable to build a host bootdisk image due to missing dosfstools package - Failed to format the ESP image via mkfs.msdos
BZ - 1857184 - selinux is preventing to build a bootdisk iso - Failed to format the ESP image via mkfs.msdos
BZ - 1857377 - Capsule Upgrade Playbook fails with "Failed to initialize: NoMethodError - undefined method `default_capsule' for Katello:Module"
BZ - 1857506 - Capsule Upgrade Fail: satellite-installer --scenario capsule --upgrade throws NameError
BZ - 1857572 - tailoring-file and scap-content command of hammer downloads file with wrong filename.
BZ - 1857726 - Warnings are shown during the satellite package installation on RHEL 7.9
BZ - 1858237 - Upgraded Satellite has duplicated katello_pools indexes
BZ - 1858284 - CVE-2020-14334 foreman: unauthorized cache read on RPM-based installations through local user
BZ - 1858819 - katello-certs-check output print foreman-installer--scenario katello instead satellite-installer --scenario satellite
BZ - 1858855 - Creating compute resources on IPV6 network does not fail gracefully
BZ - 1859158 - Unknown HTTPBoot EFI hosts are not directed to the grubx64.efi with a default grub conf
BZ - 1859194 - load_hosts macro duplicated in a list of macros
BZ - 1859276 - Need to update the deprecation warning message on Statistics and Trends page.
BZ - 1859705 - Tomcat is not running on fresh Capsule installation
BZ - 1859929 - User can perform other manifest actions while the first one starts
BZ - 1860351 - 'Host - compare content hosts packages' report fails with error 'undefined method '#first' for NilClass'
BZ - 1860407 - remote job-status table should not be re-loaded every second even if a job is running or completed
BZ - 1860422 - Host with remediations can't be removed
BZ - 1860430 - 'Host - compare content hosts packages' report: Safemode doesn't allow to access 'version'...
BZ - 1860444 - After the system reboot, capsule setup(upgraded or newly installed 6.8 capsule) fails to start the tomcat service
BZ - 1860519 - Browsing capsule /pub directory with https fails with forbidden don't have permission to access /pub/ error.
BZ - 1860585 - Content Host Registration page showing version 6.7 for repos instead 6.8
BZ - 1860587 - Documentation link in Administer -> About pointing to 6.6 document.
BZ - 1860835 - Installed Packages not displayed on About page
BZ - 1860957 - Unable to select an organization for sync management
BZ - 1861367 - Import Template sync never completes
BZ - 1861397 - UI dialog for Capsule Upgrade Playbook job doesn't state whitelist_options is required
BZ - 1861422 - Error encountered while handling the response, replying with an error message ('plugin_config')
BZ - 1861656 - smart-proxy-openscap-send command fails to upload reports to satellite.
BZ - 1861724 - ipv6: host form in interfaces are showing Error generating IP: Bad Request
BZ - 1861766 - Add ability to list traces by host with hammer
BZ - 1861807 - Cancel/Abort button should be disabled once REX job is finish
BZ - 1861816 - Error only on production builds: The Dynflow world was not initialized yet. If your plugin uses it, make sure to call Rails.application.dynflow.require! in some initializer
BZ - 1861831 - satellite-change-hostname cannot change the satellite hostname after failing.
BZ - 1861890 - Recommended repos do not match Satellite version
BZ - 1861970 - Content -> Product doesn't work when no organization is selected
BZ - 1862135 - updating hosts policy using bulk action fails with sql error
BZ - 1862445 - compliance policy creation fails for ansible deployment option on upgraded satellite.
BZ - 1862772 - Default repositories are not enabled, after registering a client with an Activation Key, to an org with Simple Content Access Mode in Red Hat Satellite 6
BZ - 1865871 - Obfuscated hosts do not have domain reported
BZ - 1865872 - Templates doc - examples on onepage.html are not processed
BZ - 1865874 - Add inventory status to host
BZ - 1865876 - Make recommendations count in hosts index a link
BZ - 1865879 - Add automatic scheduler for insights sync
BZ - 1865880 - Add an explanation how to enable insights sync
BZ - 1865928 - Templates documentation help page has hard-coded Satellite setting value
BZ - 1865943 - dynflow-sidekiq results in messages logs getting filled up more frequently
BZ - 1866029 - Templates DSL documentation: Parts of description are put in <pre> tag
BZ - 1866436 - host search filter does not work in job invocation page
BZ - 1866461 - Run action is missing in job templates page
BZ - 1866515 - ForemanVirtWhoConfigure::AuthSourceHiddenWithAuthentication is displayed on auth sources page
BZ - 1866700 - Hammer CLI is missing "resolve" (traces) option for katello-tracer
BZ - 1866710 - Wrong API endpoint path referenced for resolving host traces
BZ - 1867239 - hammer content-view version incremental-update fails with ISE
BZ - 1867287 - Error Row was updated or deleted by another transaction when deleting docker repository
BZ - 1867311 - Upgrade fails when checkpoint_segments postgres parameter configured
BZ - 1867399 - Receptor-satellite isn't able to deal with jobs where all the hosts are unknown to satellite
BZ - 1867895 - API Create vmware ComputeResource fails with "Datacenter can't be blank"
BZ - 1868183 - Unable to change virt-who hypervisor location.
BZ - 1868971 - Receptor installation job doesn't properly escape data it puts into receptor.conf
BZ - 1869640 - client-dispatcher: wrong number of arguments (given 0, expected 1..3) (ArgumentError)' messages come in upgrade and installation.
BZ - 1869812 - Tasks fail to complete under load
BZ - 1870657 - Make rake console run as a dynflow client to allow access to features provided by dynflow
BZ - 1871016 - managercli.py:1364 - Error: Unable to retrieve service levels: HTTP error (404 - Not Found)
BZ - 1871434 - theme css ".container" class rule is too generic
BZ - 1871729 - ansible-runner implementation depends on third party repository for ansible-runner package.
BZ - 1871815 - Satellite Ansible Collection - Provisioning a host fails with timeout
BZ - 1871978 - Bug in provisioning_template Module
BZ - 1872014 - Enable web console on host error in "Oops, we're sorry but something went wrong ERF42-5962 [Foreman::Exception]: No template mapped to feature Enable web console"
BZ - 1872041 - Host search returns incorrect result
BZ - 1873408 - Updating the CDN URL is manifest works fine but creates some tasks which remains in planned state with success result
BZ - 1873926 - CVE-2020-14380 Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover
BZ - 1874143 - Red Hat Inventory Uploads does not use proxy
BZ - 1874160 - Changing Content View of a Content Host needs to better inform the user around client needs
BZ - 1874168 - Sync Plan fails with 'uninitialized constant Actions::Foreman::Exception'
BZ - 1874171 - [RFE] Allow Subscription-manager service plugin for zypper (SLES) to set autorefresh in repo file
BZ - 1874172 - [6.7] Unable to re-import subscriptions in large environment (60k+ content hosts)
BZ - 1874175 - After upgrading to 6.7 and promoting content, Capsule sync is extremely slow
BZ - 1874176 - Unable to search by value of certain Hostgroup parameter
BZ - 1874422 - Hits Sync uses only old proxy setting
BZ - 1874619 - Hostgroup tag is never reported in slice
BZ - 1875357 - After upgrade server response check failed for candlepin.
BZ - 1875426 - Azure VM provision fails with error `requests.exceptions.HTTPError: 502 Server Error: Proxy Error for url`
BZ - 1875660 - Reporting Template macros host_cores is not working as expected
BZ - 1875667 - Audit page list incorrect search filter
BZ - 1877307 - [Authentication] External auth login using Kerberos SSO is failing for AD and IDM on Satellite 6.8 only
BZ - 1877354 - [Sat6/Bug] RHEL8 systems generate false positive warnings about repo binding
BZ - 1877443 - Post Satellite 6.8 Upgrade AD authentication via LDAP fails when using an A record which returns 42 entries
BZ - 1877452 - content set mappings for satellite-tools-6.8-for-rhel-8 AUS repos are missing from cdn/cs_mappings-*.csv
BZ - 1877520 - content set mappings for satellite-tools-6.8-for-rhel-8 EUS repos are missing from cdn/cs_mappings-*.csv
BZ - 1877542 - content set mappings for rhel7 satellite-tools-6.8 EUS repos are missing from cdn/cs_mappings-*.csv
BZ - 1878194 - In Capsule upgrade, "yum update" dump some error messages.
BZ - 1878556 - PXE provisioning in satellite 6.8 requires httpboot enabled
BZ - 1878693 - Unable to perform image based deployment using hosts module from Red Hat Satellite Ansible Collections
BZ - 1878850 - creating host from hg doesn't resolves the user-data template
BZ - 1879151 - Remote execution status not updating with large number of hosts
BZ - 1879448 - Add hits details to host details page
BZ - 1879451 - Stop uploading if Satellite's setting is disconnected
BZ - 1879453 - Add plugin version to report metadata
BZ - 1879571 - unable to kexec discovered hosts - satellite tries to reach wrong IP
BZ - 1880637 - [6.8] satellite-installer always runs upgrade steps
BZ - 1881066 - Safemode doesn't allow to access 'host_cores' on #<Safemode::ScopeObject>
BZ - 1881078 - Use Passenger instead of Puma as the Foreman application server
BZ - 1881988 - [RFE] IPv6 support for Satellite 6.8
BZ - 1882276 - Satellite installation fails at execution of '/usr/sbin/foreman-rake -- config -k 'remote_execution_cockpit_url' -v '/webcon/=%{host}''
BZ - 1882389 - Search query in template for LEAPP upgrade should be pre-filled when running from pre-upgrade results
BZ - 1883093 - installer-upgrade failed with error "Could not evaluate: Proxy XYZ.com cannot be retrieved: unknown error (response 500)"
BZ - 1883472 - [Sat6.8/Bug] when registering more than ~240 in parallel getting this error "HTTP error (500 - Internal Server Error): Unable to register system, not all services available"
BZ - 1887483 - Access insights pages refer to non-existing stylesheets, resulting in completely broken visuals
BZ - 1887489 - Insights rules can't be loaded on freshly installed Satellite system
BZ - 1887808 - Satellite-installer fails because of outdated RHSCL repository on DVD ISO

CVEs

References

https://access.redhat.com/security/updates/classification/#important