Foreman 1.14.0-RC3 available for testing

Foreman 1.14.0-RC3 is now available for testing, containing six or so
bug fixes for issues found in the previous release candidates.

Please help by testing and getting it release-ready, and expect the next
RC or final release within one to two weeks.

Installation quick start:

Upgrade instructions:

Release notes:

This is also a good time to improve translations for existing locales to
ensure full coverage. Help out at

Changes in this release

··· ======================= This release contains many varied changes, including:
  • Email configuration has moved into the settings UI/API
  • IPv6 address assignment or generation for hosts on compute resources
  • Orgs/locations can be assigned to LDAP users on creation
  • Session support in the API via cookies
  • Smart Proxy’s MS DHCP provider now uses a native API
  • Smart Proxy’s Puppet importer uses a new Puppet Server API

Testing of these particular changes is quite important for the release,
but many other features and bug fixes can be found listed in the release
notes by category.

Please have a look through for anything that you might rely on and give
it a test:

Two lower priority security issues have also been fixed in this release:

  • CVE-2016-7077: information disclosure from association lists shown
    without authorization
  • CVE-2016-8634: organizations/locations wizard may run stored XSS in name

Lastly, do take note of the upgrade warnings and deprecations in this


Packages may be found in the 1.14 directories on both
and, and tarballs are on

The GPG key used for RPMs and tarballs has the following fingerprint:
AF74 2A91 BF76 6333 E9FF 5EAA BFE5 1511 F06D 8950
(Foreman :: Security)

Bug reporting

If you come across a bug in your testing, please file it and note the
version of Foreman that you’re using in the report.

Foreman: Foreman
Proxy: Foreman

Dominic Cleal