RHBA-2015:0364 - Bug Fix Advisory

Topic

Updated nss, nss-softokn, nss-util, and nspr packages that fix several bugs and
add various enhancements are now available for Red Hat Enterprise Linux 7.

Description

Network Security Services (NSS) is a set of libraries designed to support
cross-platform development of security-enabled client and server applications.
Netscape Portable Runtime (NSPR) provides platform independence for non-GUI
operating system facilities.

The nss, nss-softokn, and nss-util packages have been upgraded to upstream
versions 3.16.2.3, and the nspr packages have been upgraded to upstream version
4.10.6. The upgraded versions provide a number of bug fixes and enhancements
over the previous versions, including:

• Updating to Firefox 31.3 is possible.
• The softokn database code now checks the "NSS_SDB_USE_CACHE" environment

variable. As a result, using libcurl and curl for HTTPS requests no longer
results in unnecessary access system calls to non-existent paths, directories,
and files.
(BZ#1103250, BZ#1103251, BZ#1103252, BZ#1103925, BZ#1158161, BZ#1117959)

This update also fixes the following bugs:

• NSS changed the permissions of the /etc/pki/nssdb/pkcs11.txt file to the

strict default value of 0600, even if the file had other permissions prior to
this change. Consequently, users could not add security modules to their
configuration under certain circumstances. NSS now only applies the strict
default to new files and preserves existing permissions when replacing an
existing pkcs11.txt. Users can make the necessary modifications to the NSS
security module database. (BZ#1087926)

• The internal NSS stan_GetCERTCertificate() call did not properly ensure that

objects were not removed until the operation was finished. Consequently,
stan_GetCERTCertificate() could terminate unexpectedly in the 389 Directory
Server (DS) under the replication replay failure condition. The source code has
been modified to properly manage object references, and the crashes reported by
389 DS no longer occur. (BZ#1094468)

• The PKCS#12 decoder did not properly check the destination buffer length when

decoding. Running the pk12util tool with the "-l" option to list the contents of
certain PKCS#12-encoded files resulted in a segmentation fault. The decoder has
been updated to perform the check, and pk12util now lists the encoded files as
expected. (BZ#1174527)

• A build-time check for platforms without NSS initialization support was

missing. The NSS security tools terminated unexpectedly with a core dump when
running on the 64-bit PowerPC architecture. The build files now check for the
"NSS_NO_INIT_SUPPORT" build-time environment variable, and if it is set, the
platforms continue to function as expected. (BZ#1154232)

• The Softoken module did not correctly check the mechanism for user tokens.

When both the client and the server worked in FIPS mode, the yum utility could
not connect to OpenSSL-based servers, and the server returned the "decryption
failed or bad record mac" error message. Softoken has been updated to allow user
slots to have the full list of mechanisms just like the main slot, and yum is
now able to connect to OpenSSL-based servers. (BZ#1131079)

• Certain changes to the nss-softokn.spec file were implemented using the dracut

utility configuration syntax for Red Hat Enterprise Linux 6 instead of the Red
Hat Enterprise Linux 7 syntax. Consequently, the user could not use the curl
utility to download an HTTPS URL in the dracut environment. The spec file has
been modified to use the correct syntax, and dracut users can now use curl in
this situation as expected. (BZ#1169957)

In addition, this update adds the following enhancements:

• With this update, the nss-softokn module conforms to the FIPS-140 standard.

(BZ#1004102, BZ#1004107)

• This update adds a mechanism that allows to derive a new symmetric key based

on the encryption of some data with the original symmetric key. (BZ#1155340)

Users of nss, nss-softokn, nss-util, and nspr are advised to upgrade to these
updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 1004102 - NSS needs to conform to new FIPS standard. [rhel-7.0.0]
• BZ - 1004107 - softoken needs to address FIPS review comments.
• BZ - 1087507 - Suboptimal shell code in nss.spec [rhel-7]
• BZ - 1087926 - file permissions of pkcs11.txt/secmod.db must be kept when modified by NSS
• BZ - 1094468 - 389-ds-base server reported crash in stan_GetCERTCertificate (pki3hack.c) under the replication replay failure condition
• BZ - 1103250 - Rebase RHEL 7.1 to NSPR 4.10.6 (for FF 31)
• BZ - 1103251 - Rebase RHEL 7.1 to at least NSS-UTIL 3.16.1 (for FF 31)
• BZ - 1103252 - Rebase RHEL 7.1 to at least NSS 3.16.1 (FF 31)
• BZ - 1103925 - Rebase RHEL 7.1 to at least NSS-SOFTOKN 3.16.1 (FF 31)
• BZ - 1109793 - Can't initialize a null password database if persistently in FIPS mode.
• BZ - 1117959 - Can curl HTTPS requests make fewer access system calls? [rhel-7]
• BZ - 1131079 - TLS client gets SSL_ERROR_BAD_MAC_ALERT in FIPS mode if NSS is initialized twice (without/with certdir)
• BZ - 1150645 - Importing an RSA private key fails if p < q [rhel-7]
• BZ - 1154232 - nss tools core dump on ppc64 due to recent changes in softoken and freebl
• BZ - 1155340 - Provide sym key derive mechansm as result of encryption of message
• BZ - 1156406 - NSS fails to access sql:/etc/pki/nssdb in system FIPS mode
• BZ - 1158161 - Upgrade to NSS 3.16.2.3 for Firefox 31.3 [rhel-7.1.0]
• BZ - 1169957 - curl unable to download url when url is https and environment is dracut
• BZ - 1174527 - Segfault in pk12util when using -l option with certain .p12 files

CVEs

• CVE-2014-1545

References

(none)