RHBA-2012:0920 - Bug Fix Advisory

Topic

Updated jss packages that fix several bugs are now available for Red Hat
Enterprise Linux 6.

Description

JSS (Java Security Services) is a Java binding to Network Security Services
(NSS), which provides SSL/TLS network protocols and other security services in
the Public Key Infrastructure (PKI) suite. JSS is primarily utilized by the
Certificate Server.

This update fixes the following bugs:

• During key archival process, DRM (Data Recovery Manager) decrypted user's

private keys and then re-encrypted the keys for storage purposes. The reverse
process took place during key recovery; therefore, the private key was not
processed in a token at all times as the decrypted private key was present in
the DRM memory between the time of decryption and encryption. This update adds
the secure PKCS #12 and PKCS #5 v2.0 support, support for wrapping and
unwrapping private keys in their token, and secure private key handling for TMS
(Token Management System) key recovery to Red Hat Certificate System 8.1. As a
result, the key archival operations now happen in the token. (BZ#767768)

• The "kra.storageUnit.hardware" configuration parameter did not exist in DRM's

CS.cfg after upgrade. Consequently, if parameter "kra.storageUnit.hardware" was
defined, recovery operations failed and the server returned the following error
message:

PKCS #12 Creation Failed java.lang.IllegalArgumentException: bagType or
bagContent is null

This update modifies the jss, pki-kra, pki-common components so that the
"kra.storageUnit.hardware" configuration parameter is processed correctly. As a
result, the key archival and recovery process is successful on in-place upgraded
and migrated instances. (BZ#767771)

• Previously, JSS was using the HSM (Hardware Security Module) token name as

manufacturer ID. If the HSM token name differed from the manufacturer ID, the
key archival and recovery failed. This update adds logic to JSS so that it can
recognize the currently supported HSMs: nCipher and SafeNet. Key archival and
recovery in TMS and non-TMS Common Criteria environments now work as expected.
(BZ#767773)

All users of jss are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously-released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/knowledge/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

CVEs

(none)

References

(none)