Synopsis Important: Red Hat Enterprise Virtualization Manager 3.5.0 Type/Severity Security Advisory: Important Topic Red Hat Enterprise Virtualization Manager 3.5.0 is now available. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. Description Red Hat Enterprise Virtualization Manager is a visual tool for centrally managing collections of virtual servers running Red Hat Enterprise Linux and Microsoft Windows.
Ticket 418 - Error with register-ds-admin.pl - Ticket 377 - Unchecked use of SELinux. Ticket 48017 - add script to generate lib389 CI test script - Ticket 48019. Not dn syntax - Ticket 48254 - Shell CLI fails with usage errors if an argument. Update to upstream 3.4.0.5 in order to support version 3.4 of the oVirt project.
This package also includes the Red Hat Enterprise Virtualization Manager API, a set of scriptable commands that give administrators the ability to perform queries and operations on Red Hat Enterprise Virtualization Manager. The Manager is a JBoss Application Server application that provides several interfaces through which the virtual environment can be accessed and interacted with, including an Administration Portal, a User Portal, and a Representational State Transfer (REST) Application Programming Interface (API). It was discovered that the HttpClient incorrectly extracted the host name from an X.509 certificate subject's Common Name (CN) field. A man-in-the-middle attacker could use this flaw to spoof an SSL server using a specially crafted X.509 certificate. (CVE-2012-6153, CVE-2014-3577) A Cross-Site Request Forgery (CSRF) flaw was found in the oVirt REST API. A remote attacker could provide a specially crafted web page that, when visited by a user with a valid REST API session, would allow the attacker to trigger calls to the oVirt REST API.
(CVE-2014-0151) It was found that the oVirt web admin interface did not include the HttpOnly flag when setting session IDs with the Set-Cookie header. This flaw could make it is easier for a remote attacker to hijack an oVirt web admin session by leveraging a cross-site scripting (XSS) vulnerability. (CVE-2014-0154) The CVE-2012-6153 issue was discovered by Florian Weimer of Red Hat Product Security. These updated Red Hat Enterprise Virtualization Manager packages also include numerous bug fixes and various enhancements. Space precludes documenting all of these changes in this advisory. Users are directed to the Red Hat Enterprise Virtualization 3.5 Manager Release Notes document, linked to in the References, for information on the most significant of these changes.
All Red Hat Enterprise Virtualization Manager users are advised to upgrade to these updated packages, which resolve these issues and add these enhancements. Solution Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Note: More recent versions of these packages may be available. Click a package name for more details.
We've prepared firmware 3.9.42.9152. Please see below for the changelog and links to the firmware binaries. This is a stable release which has been posted to our website, and pushed out to various recent controller branches (5.6+). This firmware was not released as stable for all UniFi devices. If any model(s) of AP you have aren't listed, and they are on 3.9.41 or later, then you may need to run a command via shell to get that device off of its current firmware. We have a thread detailing that process. Firmware changes since 3.9.27:.
UAPG2/G3 Enable multi-hop wireless uplink on all (G2/G3) UAPs. UAPG2/G3 Fix a couple issues with fast roaming when open SSIDs are also present. UAPG2/G3 Fix guest portal support. UAPG2/G3 Remove CCQ reporting from SNMP, as it is unsupported on these devices. UAPG3 Add RADIUS authentication tracking.
UAPG3 Enable uplink priority support. UAPG3 Fix L3 adoption issue. UAPG2 Improve reliability under heavy load.
UAPG2 Fix 2.4GHz disconnect issue. UAPG2 Fix priority uplink support. UAPG2 Fix an issue with client reassociation for SSIDs with Fast Roaming enabled. UAPG2 Fix a bug which may trigger a network loop when using wireless uplinks. UAPG2 Fix broadcast leak when using DVLAN. UAPG1 Fix SNMP support.
XG/BaseStationXG Enable VHT160 support. nanoHD/IW-HD Add wireless uplink support. nanoHD/IW-HD Add support for priority uplink selection.
nanoHD/IW-HD Add RF environment scanning. nanoHD /IW-HD Add RADIUS MAC Auth support. nanoHD /IW-HD Add UAPSD support for multi BSSIDs. nanoHD /IW-HD Add legacy device support. nanoHD/IW-HD Improve 5GHz rate control algorithm.
nanoHD/IW-HD Improve auto channel selection. nanoHD /IW-HD Improve 2.4GHz auto channel selection. nanoHD /IW-HD Improve speed for non-guest VAPs, when guest VAPs are also present. nanoHD /IW-HD Bandsteering changes, bringing it inline with other UAPs (that support bandsteering).
nanoHD /IW-HD Fix Ethernet status reporting. nanoHD/IW-HD Fix 802.11w support. nanoHD /IW-HD Fix broadcast filter.
nanoHD /IW-HD Fix bandsteering disconnection issue. nanoHD /IW-HD Fix a potential RADIUS accounting bug. nanoHD /IW-HD Fix MAC ACL. nanoHD/IW-HD Fix a bug which caused the MAC address filter to not work in some cases. nanoHD /IW-HD Fix a bug with bandsteering so 2.4GHz only client STAs can connect (reported ).
nanoHD/IW-HD Fix a bug that prevented client STAs from connecting to hidden 2.4GHz SSIDs. nanoHD/IW-HD Stability and performance improvements. nanoHD/IW-HD Remove old guest client STAs once disconnected from the network (reported ). nanoHD/IW-HD Add VHT160 support for RF Environment scanning.
nanoHD /IW-HD Fix hidden SSID provisioning. nanoHD /IW-HD Fix reported signal of neighboring APs (reported ).
nanoHD/IW-HD Fix an issue with TX power provisioning. nanoHD /IW-HD Performance and stability improvements. IW-HD Fix DVLAN issue.
UAP Add process restart and exit status events. UAP Add RTT latency tracking. UAP Add authentication tracking. UAP Improve client statistics reporting. UAP Fix a bug with MeshV3 wireless adoption. UAP Fix reported client STA signal.
UAP Fix a print issue with stainfo, where RSSI bleeds into TX rate. UAP Fix TX retry accounting. UAP Fix uplink status reporting.
UAP Fix rate limiting on non-guest SSIDs. UAP Fix the memory leak when using broadcast/multicast filter and RADIUS assigned VLANs. UAP Disable PMKSA caching by default. USW Add Port Security and MAC ACL support.
USW Add 802.1X guest VLAN support. USW Restart DHCP client after a port is up. USW Fix LAN client stats when using LACP/LAG. USW Fix issue with default VLAN not working when using MAB. USW Fix ability to toggle flow control. USW Disable SNMP by default. USW Reduce max VLANs to 255 (default), which lowers memory use by 10%.
USW Fix RADIUS server provisioning. HW Fix inform URL caching issue. HW Add URL support for DHCP option 43. HW Several fast-apply provisioning improvements.
HW Unify several modules across various UniFi platforms (UAP, USW and USG). HW Various bug fixes and improvements. SEC Security improvements. One is of medium/low severity It was privately disclosed and it requires external data otherwise it's not possible to exploit. The other is of low/medium severity. It was discovered internally.Controller support may vary/ pending. NOTE: You may start to see EVTAPRestartProc events in the controller log.
If you see these, please report if there is anything specifically in your setup that triggers the events. The processes restarting is not new, but the reporting of the restarting is, and we are using these reports to clean up these issues. IMPORTANT NOTE: In preparation for an upcoming code merge, we've updated the minimum firmware version to 3.9.42 for certain hardware. That means if you flash this firmware onto any HD/SHD/XG/BaseStationXG then you will not be able to downgrade to firmware prior to 3.9.42.
Download:. UAP-AC-Lite/LR/Pro/EDU/M/M-PRO/IW/IW-Pro. UAP-HD/SHD/XG/ BaseStationXG.See important note above. UAP-nanoHD /IW-HD. UAP-v2, UAP-LR-v2. USW. US-L2-POE.
US-16-XG. USW-Multi.This firmware is meant to be a one file solution that works with all models of UniFi switch. You can use it when upgrading from 3.9.40+ only. It will not work when upgrading from earlier releases. Any and all feedback is welcome, including lettings us know about successful device upgrades. When reporting an issue, please ensure that you include the following information:. Controller version.
Firmware version (previous and current). Device model(s). Links are all HTTPS. This assumes your device(s) are currently running at least 3.7.51, and that the device's date is properly set (i.e.
It can reach a NTP server). If you encounter issues with the upgrade, or your device isn't on a minimum supported firmware, then you can change the link to HTTP before performing the upgrade.