-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

=====================================================================
                   Red Hat Security Advisory

Synopsis:          Moderate: tfm-rubygem-fusor_ui security update
Advisory ID:       RHSA-2017:0256-01
Product:           Red Hat Quickstart Installer
Advisory URL:      https://access.redhat.com/errata/RHSA-2017:0256
Issue date:        2017-02-06
CVE Names:         CVE-2016-7060 
=====================================================================

1. Summary:

An update for tfm-rubygem-fusor_ui is now available for Red Hat QCI 1.0.

Red Hat Product Security has rated this update as having a security impact
of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which
gives a detailed severity rating, is available for each vulnerability from
the CVE link(s) in the References section.

2. Relevant releases/architectures:

QCI Installer - noarch

3. Description:

QuickStart Cloud Installer (QCI) is designed to drastically simplify the
deployment experience of provisioning your private cloud infrastructure by
orchestrating the installation work flow across different products. Instead
of installing each product separately, QCI provides an intuitive, web-based
graphical user interface to provision a fully functional cloud environment
based on the combination of products selected by the user.

Security Fix(es):

* It was found that several password fields in QCI failed to properly mask
the password while it was being entered. An attacker with physical access
or the ability to view the screen would be able to see the passwords as
they are being entered, allowing them to later access accounts and services
protected by those passwords. (CVE-2016-7060)

This issue was discovered by QCI QE Team (Red Hat).

4. Solution:

For details on how to apply this update, which includes the changes
described in this advisory, refer to:

https://access.redhat.com/articles/11258

5. Bugs fixed (https://bugzilla.redhat.com/):

1379909 - CVE-2016-7060 Red Hat QCI: qci exposes password in web UI when they should be masked

6. Package List:

QCI Installer:

Source:
tfm-rubygem-fusor_ui-1.0.9.1-1.el7sat.src.rpm

noarch:
tfm-rubygem-fusor_ui-1.0.9.1-1.el7sat.noarch.rpm
tfm-rubygem-fusor_ui-doc-1.0.9.1-1.el7sat.noarch.rpm

These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from
https://access.redhat.com/security/team/key/

7. References:

https://access.redhat.com/security/cve/CVE-2016-7060
https://access.redhat.com/security/updates/classification/#moderate


8. Contact:

The Red Hat security contact is <secalert@redhat.com>. More contact
details at https://access.redhat.com/security/team/contact/

Copyright 2017 Red Hat, Inc.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1

iD8DBQFYmN3iXlSAg2UNWIIRArynAJ9EyaI9dMb6ck6mglNzNETtFrvG1wCgqLTY
s5dRXhWqlIeQbyZs9JlLlbM=
=6HV7
-----END PGP SIGNATURE-----


--
RHSA-announce mailing list
RHSA-announce@redhat.com
https://www.redhat.com/mailman/listinfo/rhsa-announce