RHBA-2013:1699 - Bug Fix Advisory

Topic

Updated coolkey packages that fix several bugs and add one enhancement are now
available for Red Hat Enterprise Linux 6.

Description

Coolkey is a smart card support library for the CoolKey, Common Access Card
(CAC), and Personal Identity Verification (PIV) smart cards.

This update fixes the following bugs:

• In previous versions, coolkey always created a bogus e-gate smart card reader

to avoid problems with Network Security Services (NSS) and the PC/SC Lite
framework when no smart card reader was available. However, e-gate smart cards
are no longer available for smart card authentication, and the NSS and pcsc-lite
packages have been updated to handle a situation with no e-gate reader attached.
Therefore, this bogus reader in coolkey became unnecessary and could cause
problems to some applications under certain circumstances. This update modifies
the respective code so that coolkey no longer creates a bogus e-gate smart card.
(BZ#806038)

• With a previous version of coolkey, some signature operations, such as PKINIT,

could fail on PIV endpoint cards that support both CAC and PIV interfaces. The
underlying coolkey code has been modified so these PIV endpoint cards now works
with coolkey as expected. (BZ#906537)

• The coolkey library registered only with the NSS DBM database, however, NSS

now uses also the SQLite database format, which is preferred. This update
modifies coolkey to register properly with both NSS databases. (BZ#991515)

In addition, this update adds the following enhancement:

• Support for tokens containing Elliptic Curve Cryptography (ECC) certificates

has been added to the coolkey packages so the coolkey library now works with ECC
provisioned cards. (BZ#951272)

Users of coolkey are advised to upgrade to these updated packages, which fix
these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/site/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386

Fixes

• BZ - 806038 - Coolkey always creates a phantom EGate reader even when no reader exists.
• BZ - 906537 - CAC card ( Gemalto GCX4 72k) shows invalid-signature message during pkinit
• BZ - 991515 - Coolkey not registered in /etc/pki/nssdb/pkcs11.txt
• BZ - 1002222 - Screen Lock when Smart Card is removed fails
• BZ - 1005334 - Unable to login using smart card after adding the coolkey module to /etc/pki/nssdb
• BZ - 1013658 - Brand new applet-less cards not recognized.

CVEs

(none)

References

(none)