RHBA-2015:0346 - Bug Fix Advisory

Topic

Updated pki-core packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 7.

Description

Red Hat Certificate System is an enterprise software system designed to manage enterprise public key infrastructure (PKI) deployments. PKI Core contains fundamental packages required by Red Hat Certificate System, which comprise the Certificate Authority (CA) subsystem.

The pki-core packages have been upgraded to upstream version 10.1, which provides a number of bug fixes and enhancements over the previous version, including:

• Upgraded the RESTeasy framework to a higher version. As a result, among other things, the interceptors server code implements the JAX-RS 2.0 API.
• Modified the Tomcat framework to use the systemd service unit files to start instead of the system V initialization scripts. This involved adding new Dogtag systemd unit files.
• Updated the REST API interface to use standard HTTP return codes under various operations. Also, added paging support to most search operations.
• Added new REST API interfaces for managing certificate profiles on the CA, including methods to manage profiles, extensions to the pki command-line tool to perform these operations, and a new method to provide enrollment templates to end-entity users for specific profiles.
• Improved the pki command-line tool, which involved organizing the pki commands according to the target of the performed operation. The previously used forms of the pki commands are still available to ensure backward compatibility.

(BZ#1108303)

This update also fixes the following bugs:

• The pki-core components are not supported on the little-endian variant of IBM Power Systems architecture. Previously, this architecture was not present on the ExcludeArch line of the pki-core spec file. Consequently, pki-core attempted to build on the little-endian variant of IBM Power Systems architecture hosts. This update adds the architecture to the ExcludeArch line, and pki-core no longer attempts to build on it. (BZ#1117073)
• Previously, the CA incorrectly altered its encoding for the CertificateIssuerName class when issuing certificates. As a consequence, the CA did not trust any of the internal certificates it issued. The underlying source code has been modified to ensure that the encoding for the distinguished name (DN) of the issuer and the DN of the subject is the same as the encoding for the CA certificates. Now, the CA trusts the certificates it issues as expected. (BZ#1151147)
• Previously, pki-core required the Secure Sockets Layer version 3 (SSLv3) protocol ranges to communicate with 389-ds-base. However, recent changes to the 389-ds-base packages disabled the default use of SSLv3 and enforced using protocol ranges supported by secure protocols, such as the Transport Layer Security (TLS) protocol. As a consequence, the CA failed to install during an IdM server installation. This update adds TLS-related parameters to the server.xml file of the CA to fix this problem, and running the "ipa-server-install" command now installs the CA as expected. (BZ#1158410)
• Previously, certain pki-core shell scripts did not work as expected when invoked by running the systemctl process. The source code for the shell scripts has been modified, and they now work as expected. (BZ#1165351)

In addition, this update adds the following enhancement:

• When the pkispawn tool uses an external CA, it does not add any X.509 version 3 (X.509 v3) extensions to the certificate signing request (CSR) to signify to the CA that the request is for a subordinate CA. This update adds the "pki_req_ext_add", "pki_req_ext_oid", "pki_req_ext_critical", and "pki_rq_ext_data" configuration parameters that can be used to add an extra request extension to the CSR of a CA signing certificate. Note that the parameters are available only in cases where an external CA is used and that you can add only one extension. (BZ#790924)

Users of pki-core are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64

Fixes

• BZ - 1108303 - Rebase pki-core to 10.1
• BZ - 1151147 - External CA install does not work with CA certificates signed by Microsoft Certificate Services
• BZ - 1158410 - ipa-server-install failing with error message - CA did not start in 300.0s
• BZ - 1165351 - Errata TPS test fails due to dependent packages not found

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal