Stay Secure with the Latest Linux Advisories

security advisorysecurity updatebug fix

RedHat: RHSA-2022:5612-01 Critical: RHUI 4.1.2 Security Updates

An updated version of Red Hat Update Infrastructure (RHUI) is now available. RHUI 4.1.1 introduces important enhancements and fixes several security bugs. 2. Relevant releases/architectures:. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: RHUI 4.1.1 release - Security Fixes and Enhancement Update Advisory ID: RHSA-2022:5602-01 Product: Red Hat Update Infrastructure Advisory URL: https://access.redhat.com/errata/RHSA-2022:5602 Issue date: 2022-07-19 CVE Names: CVE-2022-28346 CVE-2022-28347 ==================================================================== 1. Summary: An updated version of Red Hat Update Infrastructure (RHUI) is now available. RHUI 4.1.1 introduces important enhancements and fixes several security bugs. 2. Relevant releases/architectures: RHUI 4 for RHEL 8 - noarch, x86_64 3. Description: Red Hat Update Infrastructure (RHUI) offers a highly scalable, highly redundant framework that enables you to manage repositories and content. It also enables cloud providers to deliver content and updates to Red Hat Enterprise Linux (RHEL) instances. Security Fix(es): * Django: SQL injection via QuerySet's annotate, aggregate, and extra functions (CVE-2022-28346) * Django: SQL injection via QuerySet's explain function on PostgreSQL (CVE-2022-28347) This update fixes the following bugs: * Previously, when a path for a non-RHUI repository was used in the entitlement certificate, RHUI Manager logged the following error message in the `/var/log/messages` file: ... Invalid entitlement path %s found ... With this update, the error message has been clarified and reworded to the following message: ... Invalid repository download URL: %s provided ... In addition, this RHUI update introduces the following enhancements: * With this update, containers are now supported on RHUI. You can perform the following operations: ** Addcontainers to RHUI ** Synchronize these containers regularly along with containers from `registry.redhat.io` or any other registry of your choice ** Offer the containers to client virtual machines using a special client configuration RPM. You can create the configuration RPM using the `rhui-manager` text user interface. * With this update, the repository synchronization status, the validity status of the RHUI CA certificate, and the statuses of services running on the RHUA, CDS, and HAProxy nodes are now available. In the case of services running on the nodes, you can view the statuses by running the `rhui-manager status` command on the RHUA node.(BZ#1636435) * With this update, you can specify the following certificates and keys during RHUI installation: ** Custom CA certificates and keys on the RHUA node ** Custom CA certificate and key that will be used to generate client entitlement certificates ** Custom CA certificate and key that will be used to generate client SSL certificates ** Custom SSL certificate and key for the web server when adding a CDS node. Note that this certificate must be usable for all the load balancersand CDS host names that you are using with your RHUI installation(BZ#2010343) * Previously, you could only access repositories by using paths with the `/pulp/content` prefix. With this update, you can now access repositories using paths containing other predefined prefixes. In addition, you can also configure protected and unprotected custom repositories to use custom prefixes.(BZ#2079376) Users of RHUI are advised to upgrade to these updated packages that fix these bugs and add these enhancements. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For detailed instructions on how to apply this update,see: https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4/html/migrating_red_hat_update_infrastructure/assembly_upgrading-red-hat-update-infrastructure_migrating-red-hat-update-infrastructure For other information, consult the product documentation at: https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4 5. Bugs fixed (https://bugzilla.redhat.com/): 1636435 - RFE: script to show the status of all RHUI related services 1890389 - /usr/lib/python2.7/site-packages/rhui/tools/cert_manager.py:291 verbage leads to confusion 2010343 - [RFE] Need a command to deploy custom SSL certificate using rhui-installer in RHUI 4 2072447 - CVE-2022-28346 Django: SQL injection in QuerySet.annotate(),aggregate() and extra() 2072459 - CVE-2022-28347 Django: SQL injection via QuerySet.explain(options) on PostgreSQL 2079376 - Request to remove hardcoded repo prefix "/pulp/content" from the Auth service/certificate verification service 6. Package List: RHUI 4 for RHEL8: Source: ansible-collection-community-crypto-1.7.0-4.el8ui.src.rpm createrepo_c-0.20.0-2.el8ui.src.rpm pulpcore-selinux-1.3.0-1.el8ui.src.rpm python-cryptography-3.1.1-2.el8ui.src.rpm python-django-3.2.13-2.el8ui.src.rpm python-ecdsa-0.14.1-2.el8ui.src.rpm python-future-0.18.2-5.el8ui.src.rpm python-pulp-container-2.10.3-2.el8ui.src.rpm python-pulp-container-client-2.7.1-6.el8ui.src.rpm python-pulp-rpm-3.17.5-2.el8ui.src.rpm python-pulpcore-3.17.6-3.el8ui.src.rpm python-pyOpenSSL-19.1.0-3.el8ui.src.rpm python-pycryptodomex-3.14.1-2.el8ui.src.rpm python-pyjwkest-1.4.2-6.el8ui.src.rpm python-pyjwt-1.7.1-8.el8ui.src.rpm python-requests-2.27.1-2.el8ui.src.rpm python-url-normalize-1.4.3-4.el8ui.src.rpm rhui-cds-plugin-authorizer-cert-1.0.5-1.el8ui.src.rpm rhui-cds-plugin-fetcher-1.0.5-1.el8ui.src.rpm rhui-installer-4.1.1.8-1.el8ui.src.rpm rhui-tools-4.1.1.16-1.el8ui.src.rpm noarch: ansible-collection-community-crypto-1.7.0-4.el8ui.noarch.rpm python3-pulp-container-client-2.7.1-6.el8ui.noarch.rpm python38-django-3.2.13-2.el8ui.noarch.rpm python38-ecdsa-0.14.1-2.el8ui.noarch.rpm python38-future-0.18.2-5.el8ui.noarch.rpm python38-pulp-container-2.10.3-2.el8ui.noarch.rpm python38-pulp-rpm-3.17.5-2.el8ui.noarch.rpm python38-pulpcore-3.17.6-3.el8ui.noarch.rpm python38-pyOpenSSL-19.1.0-3.el8ui.noarch.rpm python38-pyjwkest-1.4.2-6.el8ui.noarch.rpm python38-pyjwt-1.7.1-8.el8ui.noarch.rpm python38-requests-2.27.1-2.el8ui.noarch.rpm python38-url-normalize-1.4.3-4.el8ui.noarch.rpm rhui-cds-plugin-authorizer-cert-1.0.5-1.el8ui.noarch.rpm rhui-cds-plugin-fetcher-1.0.5-1.el8ui.noarch.rpm rhui-installer-4.1.1.8-1.el8ui.noarch.rpm rhui-tools-4.1.1.16-1.el8ui.noarch.rpm rhui-tools-libs-4.1.1.16-1.el8ui.noarch.rpm x86_64: createrepo_c-debuginfo-0.20.0-2.el8ui.x86_64.rpm createrepo_c-debugsource-0.20.0-2.el8ui.x86_64.rpm createrepo_c-libs-0.20.0-2.el8ui.x86_64.rpm createrepo_c-libs-debuginfo-0.20.0-2.el8ui.x86_64.rpm pulpcore-selinux-1.3.0-1.el8ui.x86_64.rpm python-cryptography-debugsource-3.1.1-2.el8ui.x86_64.rpm python-pycryptodomex-debugsource-3.14.1-2.el8ui.x86_64.rpm python3-createrepo_c-0.20.0-2.el8ui.x86_64.rpm python3-createrepo_c-debuginfo-0.20.0-2.el8ui.x86_64.rpm python38-createrepo_c-0.20.0-2.el8ui.x86_64.rpm python38-createrepo_c-debuginfo-0.20.0-2.el8ui.x86_64.rpm python38-cryptography-3.1.1-2.el8ui.x86_64.rpm python38-cryptography-debuginfo-3.1.1-2.el8ui.x86_64.rpm python38-pycryptodomex-3.14.1-2.el8ui.x86_64.rpm python38-pycryptodomex-debuginfo-3.14.1-2.el8ui.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2022-28346 https://access.redhat.com/security/cve/CVE-2022-28347 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYuFkLdzjgjWX9erEAQiSwRAAilDh6aiHbyrVrr/A9mc9tDMklle1Xa/e PTVrUfQc8iZgmf6VzdK4cDhSlXpUYGRw3uiN7zELsyp0v/5hNZhELXMCk/SKCxSk IGKj384fQOecWTiOOvED26AKmi9M9FfzDg50V6EF7TT80FQXLxgJhCmLGCrF37jD COvc94slPKXuvVsscLUW794E8DdywZwtam+Od2eM50ywJ4qEmAUgLw9X09Kmc6H3 KSrLPGx4PScwXwa8jBbTvvkq7sXa1XPBDrXj8zSByOZGSrDWb98tEZJq5tfTf4bq btJr19LwnM2LKCDYPJYVlFYAB9ASobYBwrPTKduP057e4U7NwHTpLPnAUwGcN1GT 5zzAkzkmcdG6WTQ4Yq+D9j0fQdu5mwd7sk9g7Ea2CG0bmTWkHpSgcT2j+eGJ+/av VWEGJSVKRYYSiLLmpa8F2d7JP1GBKly9oCS9mQwch0I0463VMjLEmjbTttzDuMCw 2ShbIrNXUe7pBGguSwTz+T1Luwj2GylDAukR3OuUkk1YKLIaSRRTiWvvDeE4DrEg 0DjtFTVwv9rd8k8VL1tVws6aq6NYRqJaUPKkJimICxl52k90Aie0ok7HkD67BqwN ITyoRf36JzArjluJClZACkmm6gb/EV14m6WgvMWgQmq6R8RrFww8PPCLluL93+Zj E8AVT9CzpY4=WX/1 -----END PGP SIGNATURE----- -- RHSA-announce mailing list This email address is being protected from spambots. You need JavaScript enabled to view it. . SUSE has unveiled SLES 15 SP4, filled with crucial patches and upgrades. Switch to this edition today!. Red Hat Update Infrastructure, Security Fixes, SQL Injection, Application Update. . Severity:Critical. LinuxSecurity.com Team

Jul 27, 2022 •Critical Red Hat