RHSA-2012:0421: Moderate: rhevm security and bug fix update

Red Hat Enterprise Virtualization Manager is a visual tool for centrallymanaging collections of virtual machines running Red Hat Enterprise Linuxand Microsoft Windows. These packages also include the Red Hat EnterpriseVirtualization Manager REST (Representational State Transfer) API, a set ofscriptable commands that give administrators the ability to perform queriesand operations on Red Hat Enterprise Virtualization Manager.It was found that RESTEasy was vulnerable to XML External Entity (XXE)attacks. If a remote attacker who is able to access the Red Hat EnterpriseVirtualization Manager REST API submitted a request containing an externalXML entity to a RESTEasy endpoint, the entity would be resolved, allowingthe attacker to read files accessible to the user running the applicationserver. This flaw affected DOM (Document Object Model) Document and JAXB(Java Architecture for XML Binding) input. (CVE-2012-0818)This update also fixes the following bugs: Previously the REST API was ignoring the "Accept" header. This made it impossible to retrieve detailed information about specific sub-collections,including hosts and disks. The REST API has been updated and now processesthe "Accept" header as originally intended. (BZ#771369) The "starttime" Virtual Machine property was previously always set. This meant that even Virtual Machines that were stopped, had a value for"starttime". An update has been made to ensure that the "starttime"property is only set when the Virtual Machine has been started, and isrunning. (BZ#772975) The 'rhevm-setup' script previously only ran successfully on systems with their locale set to 'enUS.UTF-8', 'enUS.utf-8', or 'enUS.utf8'. Thescript has since been updated to also run successfully in additionallocales, including 'jaJP.UTF-8'. (BZ#784860) The REST API did not previously validate that all required parameters were provided when enabling power management. The response code returnedwould also incorrectly indicate the operation had succeeded wheremandatory parameters were not supplied. An update has been made to ensurethat the power management parameters are validated correctly. (BZ#785744) Previously no warning or error was issued when the amount of free disk space on a host was low. When no free disk space remained on the host itwould become non-responsive with no prior warning. An update has been madeto report a warning in the audit log when a host's free disk space is lessthan 1000 MB, and an error when a host's free disk space is less than 500MB. (BZ#786132) When importing Virtual Machines no notification was provided if the MAC address of the network interface card clashed with that of an existingVirtual Machine. Now when this occurs a message is printed to the auditlog, highlighting the need for manual intervention. (BZ#795416) Previously it was not possible to set more, or less, than one value for SpiceSecureChannels using the rhevm-config tool. This meant it was notpossible to encrypt all SPICE channels. The rhevm-config tool has beenupdated and it is now possible to encrypt all SPICE channels, by addingthem to the SpiceSecureChannels configuration key. (BZ#784012)All Red Hat Enterprise Virtualization users are advised to upgrade to theseupdated packages, which address this vulnerability and fix these bugs.Refer to the Solution section for information about installing this update.