RHBA-2014:1613 - Bug Fix Advisory

Topic

Updated opencryptoki packages that fix two bugs are now available for Red Hat
Enterprise Linux 6.

Description

The opencryptoki packages contain version 2.11 of the PKCS#11 API, implemented
for IBM Cryptocards, such as IBM 4764 and 4765 crypto cards. This package
includes support for the IBM 4758 Cryptographic CoProcessor (with the PKCS#11
firmware loaded), the IBM eServer Cryptographic Accelerator (FC 4960 on IBM
eServer System p), the IBM Crypto Express2 (FC 0863 or FC 0870 on IBM System z),
and the IBM CP Assist for Cryptographic Function (FC 3863 on IBM System z). The
opencryptoki package also brings a software token implementation that can be
used without any cryptographic hardware. This package contains the Slot Daemon
(pkcsslotd) and general utilities.

This update fixes the following bugs:

• Previously, on the IBM System z architecture, the opencryptoki Common

Cryptographic Architecture (CCA) token was sending incorrect information to the
CKA_ECDSA_PARAMS attribute when generating an EC key pair. As a consequence,
opencryptoki failed to verify the public key. This bug has been fixed and the
CCA token now sends the correct information to CKA_ECDSA_PARAMS, and public keys
are verified successfully. (BZ#1027606)

• Prior to this update, the IBM Crypto Accelerator (ICA) token did not handle

the chunk size or tail calculation correctly in case of zero message sizes. As a
consequence, an overflow occurred leading to a general protection fault (GPF).
The underlying source code has been fixed, and GPFs no longer occur.
(BZ#1131745)

Users of opencryptoki are advised to upgrade to these updated packages, which
fix these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to
use the Red Hat Network to apply this update are available at
https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support Extension (for IBM z Systems) 6 s390x

Fixes

CVEs

(none)

References

(none)