RHSA-2020:4366: Important: Satellite 6.8 release

Red Hat Satellite is a systems management tool for Linux-based<br>infrastructure. It allows for provisioning, remote management, and<br>monitoring of multiple Linux deployments with a single centralized tool.<br>Security Fix(es):<br><li> mysql-connector-java: Connector/J unspecified vulnerability (CPU October 2018) (CVE-2018-3258)</li> <li> netty: HTTP Request Smuggling due to Transfer-Encoding whitespace mishandling (CVE-2020-7238)</li> <li> rubygem-websocket-extensions: ReDoS vulnerability in Sec-WebSocket-Extensions parser (CVE-2020-7663)</li> <li> puppet: puppet server and puppetDB may leak sensitive information via metrics API (CVE-2020-7943)</li> <li> jackson-databind: multiple serialization gadgets (CVE-2020-8840 CVE-2020-9546 CVE-2020-9547 CVE-2020-9548 CVE-2020-10968 CVE-2020-10969 CVE-2020-11619 CVE-2020-14061 CVE-2020-14062 CVE-2020-14195)</li> <li> foreman: unauthorized cache read on RPM-based installations through local user (CVE-2020-14334)</li> <li> Satellite: Local user impersonation by Single sign-on (SSO) user leads to account takeover (CVE-2020-14380)</li> <li> Django: Incorrect HTTP detection with reverse-proxy connecting via HTTPS (CVE-2019-12781)</li> <li> rubygem-rack: hijack sessions by using timing attacks targeting the session id (CVE-2019-16782)</li> <li> rubygem-secureheaders: limited header injection when using dynamic overrides with user input (CVE-2020-5216)</li> <li> rubygem-secureheaders: directive injection when using dynamic overrides with user input (CVE-2020-5217)</li> <li> rubygem-actionview: views that use the j or escapejavascript methods are susceptible to XSS attacks (CVE-2020-5267)</li> <li> puppet: Arbitrary catalog retrieval (CVE-2020-7942)</li> <li> rubygem-rack: directory traversal in Rack::Directory (CVE-2020-8161)</li> <li> rubygem-rack: percent-encoded cookies can be used to overwrite existing prefixed cookie names (CVE-2020-8184)</li> <li> hibernate-validator: Improper input validation in the interpolation of constraint error messages (CVE-2020-10693)</li> <li> puppet-agent: Puppet Agent does not properly verify SSL connection when downloading a CRL (CVE-2018-11751)</li> For more details about the security issue(s), including the impact, a CVSS<br>score, acknowledgments, and other related information, refer to the CVE<br>page(s) listed in the References section.<br>Additional Changes:<br><li> Provides the Satellite Ansible Modules that allow for full automation of your Satellite configuration and deployment.</li> <li> Adds ability to install Satellite and Capsules and manage hosts in a IPv6 network environment</li> <li> Ansible based Capsule Upgrade automation: Ability to centrally upgrade all of your Capsule servers with a single job execution.</li> <li> Platform upgrades to Postgres 12, Ansible 2.9, Ruby on Rails and latest version of Puppet</li> <li> Support for HTTP UEFI provisioning</li> <li> Support for CAC card authentication with Keycloak integration</li> <li> Add ability to upgrade Red Hat Enterprise Linux 7 hosts to version 8 using the LEAPP based tooling.</li> <li> Support for Red Hat Enterprise Linux Traces integration</li> <li> satellite-maintain &amp; foreman-maintain are now self updating</li> <li> Notifications in the UI to warn users when subscriptions are expiring.</li> The items above are not a complete list of changes. This update also fixes<br>several bugs and adds various enhancements. Documentation for these changes<br>is available from the Release Notes document linked to in the References<br>section.