(RHSA-2014:1317) Moderate: cfme security, bug fix, and enhancement update

Red Hat CloudForms Management Engine delivers the insight, control, and
automation needed to address the challenges of managing virtual
environments. CloudForms Management Engine is built on Ruby on Rails, a
model-view-controller (MVC) framework for web application development.
Action Pack implements the controller and the view components.

It was found that Red Hat CloudForms exposed default routes that were
reachable via HTTP(S) requests. An authenticated user could use this flaw
to access potentially sensitive controllers and actions that would allow
for privilege escalation. (CVE-2014-0140)

It was found that Red Hat CloudForms contained an insecure send method that
accepted user-supplied arguments. An authenticated user could use this flaw
to modify the program flow in a way that could result in privilege
escalation. (CVE-2014-3642)

These issues were discovered by Jan Rusnacko of Red Hat Product Security.

This update also fixes several bugs and adds various enhancements.
Documentation for these changes is available in the Release Notes and
Technical Notes documents linked to in the References section.

All cfme users are advised to upgrade to these updated packages, which
contain correct these issues and add these enhancements.