A RHUI 4.1.1 release - Security Fixes and Enhancement Update has been released.

RHSA-2022:5602-01: Important: RHUI 4.1.1 release - Security Fixes and Enhancement Update

=====================================================================
Red Hat Security Advisory

Synopsis: Important: RHUI 4.1.1 release - Security Fixes and Enhancement Update
Advisory ID: RHSA-2022:5602-01
Product: Red Hat Update Infrastructure
Advisory URL:   https://access.redhat.com/errata/RHSA-2022:5602
Issue date: 2022-07-19
CVE Names: CVE-2022-28346 CVE-2022-28347
=====================================================================

1. Summary:

An updated version of Red Hat Update Infrastructure (RHUI) is now
available. RHUI 4.1.1 introduces important enhancements and fixes several
security bugs.

2. Relevant releases/architectures:

RHUI 4 for RHEL 8 - noarch, x86_64

3. Description:

Red Hat Update Infrastructure (RHUI) offers a highly scalable, highly
redundant framework that enables you to manage repositories and content. It
also enables cloud providers to deliver content and updates to Red Hat
Enterprise Linux (RHEL) instances.

Security Fix(es):
* Django: SQL injection via QuerySet's annotate, aggregate, and extra
functions (CVE-2022-28346)
* Django: SQL injection via QuerySet's explain function on PostgreSQL
(CVE-2022-28347)

This update fixes the following bugs:

* Previously, when a path for a non-RHUI repository was used in the
entitlement certificate, RHUI Manager logged the following error message in
the `/var/log/messages` file:
...
Invalid entitlement path %s found
...

With this update, the error message has been clarified and reworded to the
following message:
...
Invalid repository download URL: %s provided
...

In addition, this RHUI update introduces the following enhancements:

* With this update, containers are now supported on RHUI. You can perform
the following operations:
** Add containers to RHUI
** Synchronize these containers regularly along with containers from
`registry.redhat.io` or any other registry of your choice
** Offer the containers to client virtual machines using a special client
configuration RPM. You can create the configuration RPM using the
`rhui-manager` text user interface.

* With this update, the repository synchronization status, the validity
status of the RHUI CA certificate, and the statuses of services running on
the RHUA, CDS, and HAProxy nodes are now available. In the case of services
running on the nodes, you can view the statuses by running the
`rhui-manager status` command on the RHUA node.(BZ#1636435)

* With this update, you can specify the following certificates and keys
during RHUI installation:
** Custom CA certificates and keys on the RHUA node
** Custom CA certificate and key that will be used to generate client
entitlement certificates
** Custom CA certificate and key that will be used to generate client SSL
certificates
** Custom SSL certificate and key for the web server when adding a CDS
node. Note that this certificate must be usable for all the load balancers
and CDS host names that you are using with your RHUI
installation(BZ#2010343)

* Previously, you could only access repositories by using paths with the
`/pulp/content` prefix. With this update, you can now access repositories
using paths containing other predefined prefixes. In addition, you can also
configure protected and unprotected custom repositories to use custom
prefixes.(BZ#2079376)

Users of RHUI are advised to upgrade to these updated packages that fix
these bugs and add these enhancements.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For detailed instructions on how to apply this update, see:
  https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4/html/migrating_red_hat_update_infrastructure/assembly_upgrading-red-hat-update-infrastructure_migrating-red-hat-update-infrastructure

For other information, consult the product documentation at:
  https://access.redhat.com/documentation/en-us/red_hat_update_infrastructure/4

5. Bugs fixed (  https://bugzilla.redhat.com/):

1636435 - RFE: script to show the status of all RHUI related services
1890389 - /usr/lib/python2.7/site-packages/rhui/tools/cert_manager.py:291 verbage leads to confusion
2010343 - [RFE] Need a command to deploy custom SSL certificate using rhui-installer in RHUI 4
2072447 - CVE-2022-28346 Django: SQL injection in QuerySet.annotate(),aggregate() and extra()
2072459 - CVE-2022-28347 Django: SQL injection via QuerySet.explain(options) on PostgreSQL
2079376 - Request to remove hardcoded repo prefix "/pulp/content" from the Auth service/certificate verification service

6. Package List:

RHUI 4 for RHEL 8:

Source:
ansible-collection-community-crypto-1.7.0-4.el8ui.src.rpm
createrepo_c-0.20.0-2.el8ui.src.rpm
pulpcore-selinux-1.3.0-1.el8ui.src.rpm
python-cryptography-3.1.1-2.el8ui.src.rpm
python-django-3.2.13-2.el8ui.src.rpm
python-ecdsa-0.14.1-2.el8ui.src.rpm
python-future-0.18.2-5.el8ui.src.rpm
python-pulp-container-2.10.3-2.el8ui.src.rpm
python-pulp-container-client-2.7.1-6.el8ui.src.rpm
python-pulp-rpm-3.17.5-2.el8ui.src.rpm
python-pulpcore-3.17.6-3.el8ui.src.rpm
python-pyOpenSSL-19.1.0-3.el8ui.src.rpm
python-pycryptodomex-3.14.1-2.el8ui.src.rpm
python-pyjwkest-1.4.2-6.el8ui.src.rpm
python-pyjwt-1.7.1-8.el8ui.src.rpm
python-requests-2.27.1-2.el8ui.src.rpm
python-url-normalize-1.4.3-4.el8ui.src.rpm
rhui-cds-plugin-authorizer-cert-1.0.5-1.el8ui.src.rpm
rhui-cds-plugin-fetcher-1.0.5-1.el8ui.src.rpm
rhui-installer-4.1.1.8-1.el8ui.src.rpm
rhui-tools-4.1.1.16-1.el8ui.src.rpm

noarch:
ansible-collection-community-crypto-1.7.0-4.el8ui.noarch.rpm
python3-pulp-container-client-2.7.1-6.el8ui.noarch.rpm
python38-django-3.2.13-2.el8ui.noarch.rpm
python38-ecdsa-0.14.1-2.el8ui.noarch.rpm
python38-future-0.18.2-5.el8ui.noarch.rpm
python38-pulp-container-2.10.3-2.el8ui.noarch.rpm
python38-pulp-rpm-3.17.5-2.el8ui.noarch.rpm
python38-pulpcore-3.17.6-3.el8ui.noarch.rpm
python38-pyOpenSSL-19.1.0-3.el8ui.noarch.rpm
python38-pyjwkest-1.4.2-6.el8ui.noarch.rpm
python38-pyjwt-1.7.1-8.el8ui.noarch.rpm
python38-requests-2.27.1-2.el8ui.noarch.rpm
python38-url-normalize-1.4.3-4.el8ui.noarch.rpm
rhui-cds-plugin-authorizer-cert-1.0.5-1.el8ui.noarch.rpm
rhui-cds-plugin-fetcher-1.0.5-1.el8ui.noarch.rpm
rhui-installer-4.1.1.8-1.el8ui.noarch.rpm
rhui-tools-4.1.1.16-1.el8ui.noarch.rpm
rhui-tools-libs-4.1.1.16-1.el8ui.noarch.rpm

x86_64:
createrepo_c-debuginfo-0.20.0-2.el8ui.x86_64.rpm
createrepo_c-debugsource-0.20.0-2.el8ui.x86_64.rpm
createrepo_c-libs-0.20.0-2.el8ui.x86_64.rpm
createrepo_c-libs-debuginfo-0.20.0-2.el8ui.x86_64.rpm
pulpcore-selinux-1.3.0-1.el8ui.x86_64.rpm
python-cryptography-debugsource-3.1.1-2.el8ui.x86_64.rpm
python-pycryptodomex-debugsource-3.14.1-2.el8ui.x86_64.rpm
python3-createrepo_c-0.20.0-2.el8ui.x86_64.rpm
python3-createrepo_c-debuginfo-0.20.0-2.el8ui.x86_64.rpm
python38-createrepo_c-0.20.0-2.el8ui.x86_64.rpm
python38-createrepo_c-debuginfo-0.20.0-2.el8ui.x86_64.rpm
python38-cryptography-3.1.1-2.el8ui.x86_64.rpm
python38-cryptography-debuginfo-3.1.1-2.el8ui.x86_64.rpm
python38-pycryptodomex-3.14.1-2.el8ui.x86_64.rpm
python38-pycryptodomex-debuginfo-3.14.1-2.el8ui.x86_64.rpm

These packages are GPG signed by Red Hat for security. Our key and
details on how to verify the signature are available from
  https://access.redhat.com/security/team/key/

7. References:

  https://access.redhat.com/security/cve/CVE-2022-28346
  https://access.redhat.com/security/cve/CVE-2022-28347
  https://access.redhat.com/security/updates/classification/#important

8. Contact:

The Red Hat security contact is . More contact
details at   https://access.redhat.com/security/team/contact/

Copyright 2022 Red Hat, Inc.