[RHSA-2018:1328-01] Important: CloudForms 4.6.2 bug fix and enhancement update

Mon May 7 20:45:22 UTC 2018

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Important: CloudForms 4.6.2 bug fix and enhancement update
Advisory ID:       RHSA-2018:1328-01
Product:           Red Hat CloudForms
Advisory URL:      https://access.redhat.com/errata/RHSA-2018:1328
Issue date:        2018-05-07
Cross references:  RHBA-2018:0556
CVE Names:         CVE-2018-1101 CVE-2018-1104 CVE-2018-7750 
=====================================================================

1. Summary:

An update is now available for CloudForms Management Engine 5.9.

Red Hat Product Security has rated this update as having a security impact
of Important. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available for each vulnerability
from the CVE link(s) in the References section.

2. Relevant releases/architectures:

CloudForms Management Engine 5.9 - noarch, x86_64

3. Description:

Red Hat CloudForms Management Engine delivers the insight, control, and
automation needed to address the challenges of managing virtual
environments. CloudForms Management Engine is built on Ruby on Rails, a
model-view-controller (MVC) framework for web application development.
Action Pack implements the controller and the view components.

Security Fix(es):

* python-paramiko: Authentication bypass in transport.py (CVE-2018-7750)

* ansible-tower: Privilege escalation flaw allows for organization admins
to obtain system privileges (CVE-2018-1101)

Red Hat would like to thank Graham Mainwaring of Red Hat for reporting
CVE-2018-1101.

* ansible-tower: Remote code execution by users with access to define
variables in job templates (CVE-2018-1104)

Red Hat would like to thank Simon Vikström for reporting CVE-2018-1104.

For more details about the security issue(s), including the impact, a CVSS
score, and other related information, refer to the CVE page(s) listed in
the References section.

Additional Changes:

This update also fixes several bugs and adds various enhancements.
Documentation for these changes is available from the Release Notes
document linked to in the References section.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1495849 - [ALL_LANG] VM or Template comparison screen has untranslated entries.
1510499 - With RHV Graph refresh template numbers in Provider inventory does not get updated correctly.
1526086 - [ALL_LANG] Compute - Containers - Container Builds page has missing translations
1526088 - [ALL_LANG] Compute - Containers - Pods page has missing translations
1530680 - xClarity: EvmRole-operator unable to view physical server summary page
1530760 - [ALL_LANG] Control - Explorer - Policy Profiles - All Policy Profiles : 'Policy' is not localized
1533220 - [ALL_LANG] Control - Explorer - Actions - All Actions - Configure - Add a new Action : 'Action Type' drop-down menu has untranslated entries
1533233 - On Tag Assignment  page Category has other Tags than preconfigured for it
1533515 - [ALL_LANG] User Icon - Configuration - Access Control - Roles : Add new Role has untranslated entries
1538094 - [ALL_LANG] User Icon - Tasks : untranslated entry
1538100 - [ALL_LANG] User Icon - Configuration - Settings - CFME Region: Region xx[xx] has untranslated entry
1549625 - webui updates failing when a proxy is required
1549722 - WebUI: Tool tip displays html code while setting the ownership for multiple vm's
1550728 - Replication configuration page does not open when child database is down
1550730 - [Ansible Embedded] - Embedded Ansible cannot be enabled on IPv6 only appliance
1550736 - unable to view quotas without manage quota permissoin being enabled in 5.8.2
1551692 - internal server error ActiveRecord::AssociationTypeMismatch when editing current_group
1551696 - Colons are unhandled in BaseModel key generation in AzureArmrest
1551698 - Not possible to configure GCE provider for new regions (southamerica-east1) on CFME
1551703 - RHOS: Unable to delete cloud tenant
1552266 - Duplicated choice exist in new alerts view
1552269 - Network router type string contains ManageIQ path
1552278 - Authentication issue for checking status of Task API via EvmRole_administrator privileged User
1552282 - [RFE] Make Automation State Machine Log Lines Uniform
1552288 - [RFE] Metrics for memory usage of AWS instances is missing from C&U
1552290 - AWS Smartstate Does Not Fail Gracefully if AMI To run Analysis Agent is Unavailable
1552301 - Azure Template to service Dialog conversion issue
1552303 - [Azure]Provision Multiple VMs with Public IP selection options
1552305 - GCE Region is useless in GCE Provider
1552323 - xClarity:  server-host relationship to hosts managed by RHEV-M provider not created.
1552334 - Nuage provider name is always displayed as " Network Manager" on GUI
1552335 - EventCatcher is not restarted when Nuage provider is updated
1552671 - [RFE][XS-2] Add possibility to unregister a VM in RHV provider
1552673 - Cloudforms doesn't show IP of vms on vCloud provider
1552677 - VM does not have deletion event on its own timeline on vsphere55
1552704 - Default Docker Labels for Labeled Images in Chargeback Assignments
1552707 - Wrong error displayed when trying to add a group without a name
1552723 - Can't Manage Report Menu Accordions and Folders
1552735 - Filters not working properly in config mgmt configured systems
1552737 - UI: Broken bootstrapswitch design in custom button option of generic object
1552739 - [RFE] Expose Infra provider networks (RHOS) in host/node details
1552740 - [ALL_LANG] User Icon - Configuration - Settings - Schedules : Add a new Schedule page has untranslated entries
1552741 - Can't remove multiple instances or methods in UI.
1552743 - ui: Tabs switched When changing the System/Process type on add new button page
1552746 - typo in provider summary page: metrics type Hakular --> Hawkular
1552748 - [Embedded Ansible] Notification typo
1552753 - CFME Log lines in Diagnostics are divided into multiple lines
1552762 - Error when applying a filter in My Services from Adv search
1552763 - Remove Chargeback Rates field for Metering reports
1552776 - Auth MIQLDAP AD - miqldap_to_sssd conversion fails for ldap.
1552782 - Smartstate on Azure Managed Linux Instance returns Unable to mount filesystem.  Reason:[XFS::DirectoryDataHeader: Invalid Magic Number 0]
1552783 - Unable to add playbook repos after webui update
1552785 - Auth MIQLDAP AD - Users can't log in to console after miqldap_to_sssd conversion
1552790 - Validating credentials for replication throws error if pglogical schema not created
1552791 - miqldap_to_sssd help message is incorrect
1552792 - Auth External Auth SAML - Users with custom groups with special chars can't log in.
1552794 - A control alert for real time performance of a VM and Instance is not firing
1552796 - [RFE] Chargeback reports for OpenStack tenants
1552798 - [Providers] - Instances not linked after provider removal/addition
1552800 - Retirement requester is not passed down correctly to automate
1552801 - RBAC doesn't work for notifications
1552802 - No notification for failed registration
1552804 - configure_server_settings.rb changes numeric values to strings, causing failures when other code is expecting integers
1552809 - [RFE] Support RestAPI Primary Collection for Containers (object)
1552817 - SUI doesn't display costs for SCVMM services
1552824 - Can Add Duplicate Custom Attributes on OpenShift Provider Via the API
1552826 - internal server error when cloud_networks, cloud_subnets or security_groups subcolls requested on RHEVM
1552828 - internal server error when accessing attributes of the "picture" resource
1552838 - Targeted folder refresh doesn't work on VMware
1552842 - Customize vApp template prior provisioning (VMware vCloud Provider)
1552873 - RBAC Users can be removed from all associated groups after the webui shows the error "A User must be assigned to a Group"
1552879 - Tagging broken in Datastores and My Services page
1552880 - [RFE] There is no any indication in replication subscription screen for not accessible remote node
1552882 - The quad-icon tile for an OpenShift provider shows an exclamation mark, but a mouseover shows "Refresh Status: Success"
1552884 - Cursor on password field instead of username when we enter incorrect login details
1552886 - Unwanted comma in disk type string for Azure instances
1552889 - containers: identical volume name for different volumes in different pods is not useful for users (at least not admin)
1552890 - Tagging: Edit tags page doesn't open for network list items navigated through parent details page
1552895 - Error updating Nuage provider
1552900 - Title does not update when searching text in Datastores and other pages
1552903 - Automate tree in the left pane has duplicates following any copy operation (instance, class, namespace)
1552904 - The accordion folds after adding a schedule
1552908 - Add button is not responsive on Role add page
1553191 - Timelines: Throws an error while trying to access Cloud Intel/Timelines
1553197 - Configuration -> Red Hat Updates tab does not list all required repositories
1553214 - JavaScript-UI: Wrong behavior of `display on button` checkbox while editing custom group form
1553224 - Set Ownership can not be changed back to default
1553241 - Container add provider empty flash message when not catch UI exception
1553242 - Tag: All Catalog Items are listed in resource dropdown while creating Catalog Bundle using restricted user
1553243 - Save button isn't activated when date is removed in VM "Set/Remove retirement date"
1553244 - [QEDevCollab] Components in 'Add button group' form causing test automation failures
1553251 - Chargeback Rates page title incorrect after deleting rate
1553288 - Flash message icon is not correct Bottlenecks page
1553295 - Unable to perform SSA if Vm storage is fileshare on SCVMM and throws error in evm.log
1553304 - Evacuate Host failed
1553307 - Undefined method `vmm_version' for nil:NilClass on VM summary screen
1553309 - [RFE] Generic objects not displayed
1553311 - Wrong 'Fixed IPs' font size while adding a router with external gateway
1553315 - C & U Collection settings in configuration page improper styling
1553316 - On schedules pages is shown pagination from analysis profiles
1553317 - Broken footer in alerts
1553319 - [RFE][S-3] UI displays disabled domains for a instance's domain priority
1553322 - audit.log should not contain translated messages
1553323 - Adding Interface to Router with user in Tenant show all Subnets and not only the Tenant's Subnet
1553326 - Switch icon is missed on tag assignment page
1553327 - Stack Outputs icon is not displayed
1553329 - Using webmks console one cannot type correctly the password when it contains special characters
1553336 - Default view settings fails for service catalogs
1553340 - [CONDITION] When we leave description blank, there are two identical flash messages.
1553345 - Openstack infra provider dashboard should not appear for an openstack infra provider
1553362 - Add miqssh utilities
1553384 - [RHV] VM Reconfigure: Down VM Memory increase fail on cannot exceed maximum memory
1553389 - VMware vCloud Provider's VM is only partially stopped/suspended
1553392 - EvmRole-auditor can perform actions on VM
1553393 - [RFE] Add RBAC and Tagging Support to Ansible Credentials.
1553396 - [RFE] Add RBAC and Tagging Support to Ansible Repos
1553397 - Error while checking that migrations are up to date
1553399 - Normalize text for operational alerts
1553480 - SUI : Clicking any link on dashboard does not change the navigation in left side
1553482 - Kebab menu appearing differently on service page and resource detail pages
1553483 - Kebab menu changes structure after 30 seconds in SSUI resource detail page
1553768 - [RFE] Add RBAC and Tagging Support to Ansible Playbooks
1553776 - Role inconsistency with privileges when creating reports and setting chargeback filters
1553779 - Restricted user can see all group and users
1553780 - notifications do not get cleared from the notification table
1553789 - Unable to add tag for configuration provider from 'All Rad Hat Satellites Providers'
1553791 - xClarity: Physical server summary page download as PDF button not supported
1553836 - Visibility expression does not evaluated correctly on custom buttons for Generic Object
1553873 - Missing Datastore Images
1553903 - [Regression] Backup/restore failing on appliances using pglogical
1554358 - Graph refresh should not be used for rhv36 providers
1554370 - Wrong breadcrumb link on order screen
1554454 - Adding a physical provider shows as infrastructure provider (text change)
1554532 - Schedule report fails to send mail when report is not empty
1554541 - Long time to refresh network provider on OpenStack
1554823 - Infinite spinner on Edit Playbook Reset button
1554825 - NTP server details doesn't show in UI after adding a new zone
1554832 - Automatic placement causes cloud tenant to not be selectable
1554839 - Policy simulation results are not displayed
1554889 - OpenStack Cinder Storage provider detail does not have link to Volume Backups
1554898 - when deleting an archived node using configure > remove a unknown method error is raised
1554901 - Missing Guest OS in dashboard reports in Openstack
1557130 - CVE-2018-7750 python-paramiko: Authentication bypass in transport.py
1557353 - Adding a network router via CloudForms the router is not seen by CloudForms
1557361 - [RFE][XS-2]Cloudforms does not show node hostname, only GUID for OpenStack Infrastructure Provider
1557367 - Request not required when adding Schedule
1557378 - [UI] There is no indication of cloud network delete operation
1557380 - Tagging: Edit tags page doesn't open for images opened from provider summary page
1557388 - Inconsistent capitalization of 'CPU' when creating chargeback rate
1557391 - Physical Infrastructure provider quadicons doesn't support single view
1557400 - Physical server quadicon switch under My Settings doesn't respect RBAC rules
1558030 - internal server error when accessing the "policy_events" attribute of the "vms" resource
1558038 - AWS flavor list is out of date
1558040 - Not able to scan instances in AWS
1558046 - OpenStack - Include Provider Error Message in MiqProvisionFailure
1558048 - Provision fails if no Subnet assigned not Cloud Network
1558078 - [RFE][M-5] Targeted Refresh for Azure Provider
1558092 - Dropdown to delete a "not responding" server is missing
1558142 - Network provider quadicons doesn't support single view
1558144 - UI inconsistency - Size Unit title missing when adding a new disk
1558544 - Creating buttons under the Datastore objects do not appear on Datastore Details Pages
1558594 - No event AWS_EC2_Instance_UPDATE  when renaming a VM on EC2
1558610 - Images from the webmks css causes CSP errors in browser console
1558621 - RedHat domain can be edited/deleted
1558626 - PG::InvalidTableDefinition: ERROR:  cannot alter inherited column "resource_type
1559475 - CUI returning empty array when dialog without associations is saved
1559479 - [RFE] Add RHV Credential to Ansible Automation Inside
1559483 - CUI doesn't check dialog field associations
1559543 - [RFE] Metering Reports should provide Hours of Existence & Start and end time of VMs, Projects and Images
1559544 - [RFE] Collect Container Project Quota Historical data in Project Roll-up
1559550 - Regression Instance Method check_quota Throws Error 5.8.2 to 5.8.3 undefined method provisioned_storage
1559552 - Api::ServiceCatalogsController timeout error in multi-regional environment
1559609 - Amazon agent deployment has to choose the VPC which has attached gateway configuration
1559624 - Graph refresh does not fetch custom attributes
1560004 - [RFE] SCVMM provider refresh error message issue if provider user doesn't have access to VMM service
1560096 - Error occurs when trying to edit a catalog item
1560098 - Outgoing SMTP E-mail Server settings not saved on first attempt
1560100 - Total matches of Ems Cluster roles showing wrong count
1560104 - Automate Schedule: "Starting time" field saves nonsense.
1560692 - Stop CF pestering OpenStack for Swift status when there is no Swift.
1560699 - Consolidated RefreshWorkers may cause job starvation
1560703 - Refresh is broken for ec2 when get_public_images is set to true
1560708 - My Company(All EVM Groups) filter missing from reports schedule
1561076 - Duplicate RBAC Role and Group names allowed when using different capitalization from the original name
1561079 - [Regression]Error with report policy event for the last 7 days
1561085 - [RFE] Azure Network router not displayed on CFMe
1561091 - List view displayed instead of grid on Manage Policies screen
1561096 - Default selected tag name / value mismatch when assigning tags
1561107 - ERROR -- : AnsibleTowerClient::Middleware::RaiseTowerError Response Body: {"detail"=>["'username' is not a valid field for Vault"]}
1561216 - Failure to refresh on OpenStack provider when Fog::Storage::OpenStack::File object has nil body attribute
1561218 - [RHV] PXE provision with Network "use template nics" fail on creating VM
1561222 - ping feature inconsistent with webui ping when database connectivity is lost
1562075 - Duplicate values are shown in dialog dropdown.
1562235 - Nics are Provisioned out of Order for VMware Service Provision
1562772 - tenant source_id compromisation after changing provider credentials
1562777 - Approval permissions are not followed between different groups
1562779 - Cannot create service template using the API
1562780 - [SCVMM]Extract Running Processes completed Task List does not inform about Warnings.
1562782 - A state machine's on_exit method runs before the main method if the main method is an embedded Ansible playbook
1562785 - Refresh failed after performing vm_reconfiguration_task
1562788 - [Regression] RHV provider discovery doesn't work
1562791 - Database Replication broken for current and new regions
1562797 - CFME - usage of non standard special characters (e.g. accents) in password causes user is not able to login
1562800 - Schedule Operation: Cannot create schedule, "Add" button is not active
1562803 - [RFE] CFME, add Ansible GIT repository custom SSH port option
1562811 - No Advanced Search in Volume Snapshots/Backups
1563268 - CloudForms appliance is ignoring azure proxy settings in advanced tab.
1563351 - Nuage provider is unable to refresh inventory when subnets are missing gateway address
1563358 - Nuage Networks provider does not handle empty AMQP details
1563359 - Nuage Provider doesn't capture Alarms
1563361 - Nuage provider's event catcher yields "Too many open files" after 9 hours
1563363 - VMware vCloud Provider's inventoring fails because of bug in Disk parsing
1563364 - Support console access for VMware vCloud Provider's VMs
1563492 - CVE-2018-1101 ansible-tower: Privilege escalation flaw allows for organization admins to obtain system privileges
1563731 - in the conditions screen you see "Container Node" on the left but "Node" on the right
1563740 - ReconfigVM Event triggers a refresh_sync Holding Automate Process in State Machine
1565139 - Some expression method definitions can fail with "<Script error>" in a dialog and a stack trace in evm.log
1565140 - Embedded Ansible job_status .out files are not processed by logrotate
1565142 - Nuage Provider uses qpid_proton gem version without heartbeating
1565147 - Unable to create Cloud Network due to  undefined method
1565148 - Service gets submitted even if dialog does not passes validation
1565151 - Regression Custom Button Dialog Not Displaying Submit or Cancel Button
1565156 - Unable to see realtime data from OpenShift in CloudForms UI
1565160 - Ansible playbook credentials always show default value in SUI
1565167 - openstack provisioning instance fail on checkprovisioned
1565232 - OpenStack with bad credentials shows timeout
1565677 - Container reports take too much time to generate
1565686 - VMware vCloud Provider credential validation fails
1565756 - Remove specific EVM server from zone
1565862 - CVE-2018-1104 ansible-tower: Remote code execution by users with access to define variables in job templates
1566255 - DRb 'close' error for closed connection
1566526 - Reporting worker exceeding threshold for default report tied to custom widget
1566529 - Smartstate Analysis Schedule Fails for OpenShift 3.7 Container Images
1566530 - Report for Storage Capacity Field Generating Error Cannot Convert Hash to Float
1566541 - [RFE] Target Refresh support for OpenStack Block Storage Manager
1566557 - [Regression] Infra provider discovery doesn't work
1566562 - RHSM failing to register with proxy settings
1566563 - Cloudforms present blank page for backup volumes
1566568 - Appliances Missing from Global Region are showing a Zone ID of a Local Region
1566572 - ERROR ASCII-8BIT to UTF-8","klass":"Encoding::UndefinedConversionError"}}
1566577 - [AZURE]Filter list of available Public IPs
1566658 - [PRD][RFE] Ansible Next Gen - Playbook Seeding
1567278 - xClarity: Error while execute the second refresh cycle
1567962 - VMware vCloud Provider's VMs cannot revert from snapshot
1568023 - [Embedded Ansible] Standard Output throws error if Hostname has Non-ASCII Characters
1568091 - Catalog Item with Tag Control element cannot be ordered
1568156 - Not able to import certain dialogs because of tag Id
1568158 - User Interface does not come up after reboot
1568162 - DRO Service mapping to DRO instance incorrect
1568467 - Cannot put special characters in proxy password in Advanced Config
1568473 - Saving a service dialog with a multi-select drop-down populated by expression method gives a 500 internal server error
1568550 - CFME: OpenSCAP evaluation report target machine does not show container image name
1568559 - Deployment template validation failed
1568602 - Git repo automate datastore refresh timing out upon credential change
1569099 - Orphaned and Archived VMs displayed in running vms filter
1569103 - Online VMs (Powered On) report lists Orphaned and Archived VMs/Instances
1569113 - Apache Reloaded twice with logrotate
1569177 - ERROR : 404 when trying to set the retirement date of the service
1569236 - [UI] - ManageIQ string in PDF summary file for flavors
1569472 - In dynamic dropdown list, the default value contains ALL the values of the list
1569551 - Auto-refresh values take forever to load values in dropdown
1570118 - CloudForms 4.6 - filtering based on tags does not work for catalog items
1570821 - Unable to run ansible playbook method via Simulate
1570950 - Service and VM retirement are non-deterministic, running parallel
1570989 - Service Catalog Item Subtype not rendered in UI
1571310 - Unable to select storage manager from drop down list through classic UI
1571976 - Dynamic check box does not update in Classic UI
1571989 - droplist with large amount of items do not display a search field
1572711 - Automate Methods from Dynamic Dialog are being Run More than Designed / Expected
1572716 - Delay in rendering service dialog
1572718 - Provider Inventory worker vim.log fills up due to large log messages
1573215 - OpenStack Block Storage Manager Cinder does not refreshed
1573246 - Workload category for Tag Control element does not work
1573254 - auto_refresh being used instead of dialog field responders on later versions
1573539 - Dashboard widget is not providing exact content due to Type conversion Exception.
1573990 - in certain situations the refresh methods are called on every single refresh

6. Package List:

CloudForms Management Engine 5.9:

Source:
ansible-2.4.4.0-1.el7ae.src.rpm
ansible-tower-3.2.4-1.el7at.src.rpm
cfme-5.9.2.4-1.el7cf.src.rpm
cfme-amazon-smartstate-5.9.2.4-1.el7cf.src.rpm
cfme-appliance-5.9.2.4-1.el7cf.src.rpm
cfme-gemset-5.9.2.4-1.el7cf.src.rpm
dbus-api-service-1.0.1-3.el7cf.src.rpm
httpd-configmap-generator-0.2.1-2.el7cf.src.rpm
postgresql96-9.6.6-1PGDG.el7.src.rpm
python-paramiko-2.1.1-4.el7.src.rpm
rh-ruby23-rubygem-json-2.1.0-1.el7cf.src.rpm
rh-ruby23-rubygem-qpid_proton-0.22.0-2.el7cf.src.rpm

noarch:
ansible-2.4.4.0-1.el7ae.noarch.rpm
ansible-doc-2.4.4.0-1.el7ae.noarch.rpm
python-paramiko-2.1.1-4.el7.noarch.rpm
python-paramiko-doc-2.1.1-4.el7.noarch.rpm
rh-ruby23-rubygem-qpid_proton-doc-0.22.0-2.el7cf.noarch.rpm

x86_64:
ansible-tower-3.2.4-1.el7at.x86_64.rpm
ansible-tower-server-3.2.4-1.el7at.x86_64.rpm
ansible-tower-setup-3.2.4-1.el7at.x86_64.rpm
ansible-tower-ui-3.2.4-1.el7at.x86_64.rpm
ansible-tower-venv-ansible-3.2.4-1.el7at.x86_64.rpm
ansible-tower-venv-tower-3.2.4-1.el7at.x86_64.rpm
cfme-5.9.2.4-1.el7cf.x86_64.rpm
cfme-amazon-smartstate-5.9.2.4-1.el7cf.x86_64.rpm
cfme-appliance-5.9.2.4-1.el7cf.x86_64.rpm
cfme-appliance-common-5.9.2.4-1.el7cf.x86_64.rpm
cfme-appliance-debuginfo-5.9.2.4-1.el7cf.x86_64.rpm
cfme-appliance-tools-5.9.2.4-1.el7cf.x86_64.rpm
cfme-debuginfo-5.9.2.4-1.el7cf.x86_64.rpm
cfme-gemset-5.9.2.4-1.el7cf.x86_64.rpm
cfme-gemset-debuginfo-5.9.2.4-1.el7cf.x86_64.rpm
dbus-api-service-1.0.1-3.el7cf.x86_64.rpm
httpd-configmap-generator-0.2.1-2.el7cf.x86_64.rpm
postgresql96-9.6.6-1PGDG.el7.x86_64.rpm
postgresql96-contrib-9.6.6-1PGDG.el7.x86_64.rpm
postgresql96-debuginfo-9.6.6-1PGDG.el7.x86_64.rpm
postgresql96-devel-9.6.6-1PGDG.el7.x86_64.rpm
postgresql96-docs-9.6.6-1PGDG.el7.x86_64.rpm
postgresql96-libs-9.6.6-1PGDG.el7.x86_64.rpm
postgresql96-plperl-9.6.6-1PGDG.el7.x86_64.rpm
postgresql96-plpython-9.6.6-1PGDG.el7.x86_64.rpm
postgresql96-pltcl-9.6.6-1PGDG.el7.x86_64.rpm
postgresql96-server-9.6.6-1PGDG.el7.x86_64.rpm
postgresql96-test-9.6.6-1PGDG.el7.x86_64.rpm
rh-ruby23-rubygem-json-2.1.0-1.el7cf.x86_64.rpm
rh-ruby23-rubygem-json-debuginfo-2.1.0-1.el7cf.x86_64.rpm
rh-ruby23-rubygem-json-doc-2.1.0-1.el7cf.x86_64.rpm
rh-ruby23-rubygem-qpid_proton-0.22.0-2.el7cf.x86_64.rpm
rh-ruby23-rubygem-qpid_proton-debuginfo-0.22.0-2.el7cf.x86_64.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2018-1101
https://access.redhat.com/security/cve/CVE-2018-1104
https://access.redhat.com/security/cve/CVE-2018-7750
https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is <secalert at redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2018 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFa8LreXlSAg2UNWIIRAgpQAKCCPcTt0PIPd1xkHzaulPHP6rxO9wCZARu7
6dE6DBC1gk0rgt4Iu/H7uCg=
=7C4y
-----END PGP SIGNATURE-----