RHBA-2011:0570 - Bug Fix Advisory

Topic

An updated certmonger package that fixes several bugs and adds various
enhancements is now available for Red Hat Enterprise Linux 6.

Description

The certmonger utility monitors certificate expiration and can refresh
certificates with the CAs (certifying authorities) in networks that use
public-key infrastructure (PKI).

This updated certmonger package includes numerous bug fixes and enhancements.
Space precludes documenting all of these changes in this advisory. Users are
directed to the Red Hat Enterprise Linux 6.1 Technical Notes for information on
the most significant of these changes:

https://docs.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6/html/6.1_Technical_Notes/index.html

All certmonger users are advised to upgrade to these updated packages, which
provide numerous bug fixes and enhancements.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
http://kbase.redhat.com/faq/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 624142 - certmonger defunct process ipa-submit
• BZ - 624143 - RFE: there is no way to pass in a key or database password on start-tracking
• BZ - 636894 - certmonger fails to start on new install
• BZ - 643561 - Rebase certmonger to at least 0.32
• BZ - 652047 - Unhelpful message from ipa-getcert
• BZ - 652049 - No output from ipa-getcert list
• BZ - 688229 - certmonger accepts a non-existent pin file for NSS db(with empty passwd) when '-p' option is supplied to 'ipa-getcert request'
• BZ - 689776 - Certmonger segfaults when certificate request contains non-existent NSS database directory.
• BZ - 690886 - ipa-submit crashed
• BZ - 691351 - Segmentation fault when invalid Extended Key Usage is provided in Certificate Request
• BZ - 695672 - Subject and Principal name switches are not working in case of 'getcert resubmit'
• BZ - 695675 - certificate is not generated after changing the SELinux context of directory
• BZ - 696185 - Segmentation fault on providing all four parameters (EKU, DNS, Email, Principal name) with start-tracking

CVEs

(none)

References

(none)