Issued:
2023-08-09
Updated:
2023-08-09

RHSA-2023:4591 - Moderate: RHUI 4.5.0 release - Security, Bug Fixes, and Enhancements

Synopsis

Moderate: RHUI 4.5.0 release - Security, Bug Fixes, and Enhancements

Type/Severity

Security Advisory Moderate

Topic

An updated version of Red Hat Update Infrastructure (RHUI) is now available. RHUI 4.5 fixes several security and operational bugs and also adds several new features.

Description

Red Hat Update Infrastructure (RHUI) offers a highly scalable, highly redundant framework that enables you to manage repositories and content. It also enables cloud providers to deliver content and updates to Red Hat Enterprise Linux (RHEL) instances.

Security Fix(es):

  • Django: Potential bypass of validation when uploading multiple files using a single form field (CVE-2023-31047)

  • sqlparse: Parser contains a regular expression that is vulnerable to ReDOS (Regular Expression Denial of Service) (CVE-2023-30608)

This RHUI update fixes the following bugs:

  • Previously, the rhui-manager command used the logname command to obtain the login name. However, when rhui-manager is run using the rhui-repo-sync cron job, a login name is not defined. Consequently, emails sent by the cron job contained the error message logname: no login name. With this update, rhui-manager does not obtain the login name using the logname command and the error message is no longer generated.

  • Previously, when an invalid repository ID was used with the rhui-manager command to synchronize or delete a repository, the command failed with following error: An unexpected error has occurred during the last operation. Additionally, a traceback was also logged. With this update, the error message has been improved and failure to run no longer logs a traceback.

This RHUI update introduces the following enhancements:

  • With this update, the client configuration RPMs in rhui-manager prevent subscription manager from automatically enabling yum plugins. As a result, RHUI repository users will no longer see irrelevant messages from subscription manager. (BZ#1957871)

  • With this update, you can generate machine-readable files with the status of each RHUI repository. To use this feature, run the following command: rhui-manager --non-interactive status --repo_json <output file> (BZ#2079391)

  • With this update, the rhui-manager CLI command uses a variety of unique exit codes to indicate different types of errors. For example, if you attempt to add a Red Hat repository that has already been added, the command will exit with a status of 245. However, if you attempt to add a Red Hat repository that does not exist in the RHUI entitlement, the command will exit with a status of 246. For a complete list of codes, see the /usr/lib/python3.6/site-packages/rhui/common/rhui_exit_codes.py file.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For detailed instructions on how to apply this update, see: https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4/html/migrating_red_hat_update_infrastructure/assembly_upgrading-red-hat-update-infrastructure_migrating-red-hat-update-infrastructure

For other information, see the product documentation: https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4

Affected Products

ProductVersionArch
Red Hat Update Infrastructure4x86_64

Updated Packages

  • python39-sqlparse-0.4.4-1.0.1.el8ui.noarch.rpm
  • rhui-tools-libs-4.5.0.5-1.el8ui.noarch.rpm
  • python-django-3.2.19-1.0.1.el8ui.src.rpm
  • python39-django-3.2.19-1.0.1.el8ui.noarch.rpm
  • rhui-installer-4.5.0.1-1.el8ui.src.rpm
  • rhui-tools-4.5.0.5-1.el8ui.noarch.rpm
  • python-sqlparse-0.4.4-1.0.1.el8ui.src.rpm
  • rhui-installer-4.5.0.1-1.el8ui.noarch.rpm
  • rhui-tools-4.5.0.5-1.el8ui.src.rpm

Fixes

CVEs

References

Additional information