RHBA-2011:1675 - Bug Fix Advisory

Topic

An updated jss package that fixes various bugs is now available for Red Hat
Enterprise Linux 6.

Description

JSS is a Java binding to Network Security Services (NSS), which provides SSL/TLS
network protocols and other security services in the Public Key Infrastructure
(PKI) suite. JSS is primarily utilized by the Certificate Server.

This update fixes the following bugs:

• The java.net.SocketException was accompanied by a misleading error message

because the exception definition was using a variable pointed to a wrong
address. With this update, the underlying code has been modified and the
exception now uses the correct error message. (BZ#660436)

• On Luna SA HSM in FIPS mode, Red Hat Certificate System failed to generate a

certificate and threw an exception if ECC (Elliptic Curve Cryptography)
algorithms was set to higher than SHA1withEC. This occurred because in FIPS
mode, the SSL protocol requires ECDH (Elliptic Curve Diffie Hellman), which is
not supported by Luna SA. With this update, the ECDH support has been provided
by JSS/NSS, and certificates are created and used with SSL correctly.
(BZ#705947)

• In FIPS mode, DRM (Data Recovery Manager) failed to recover keys because it

failed to import the respective key. With this update, the key is generated on
recovery and the recovery succeeds. (BZ#733551)

All users of jss are advised to upgrade to this updated package, which fixes
these bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/kb/docs/DOC-11259

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

• BZ - 660436 - Warnings should be cleaned up in JSS build
• BZ - 705947 - Cannot create system certs when using LunaSA HSM in FIPS Mode and ECC algorithms
• BZ - 715621 - Defects revealed by Coverity scan
• BZ - 733551 - DRM failed to recovery keys when in FIPS mode (HSM + NSS)

CVEs

(none)

References

(none)