RHBA-2015:0507 - Bug Fix Advisory

Topic

Updated pam_pkcs11 packages that fix several bugs are now available for Red Hat
Enterprise Linux 7.

Description

The pam_pkcs11 packages allow the X.509 certificate-based user authentication.
The packages provide access to the certificate and its dedicated private key
with an appropriate Public Key Cryptographic Standards #11 (PKCS#11) module.

This update fixes the following bugs:

• Previously, the spec file for the pam_pkcs11 packages contained flags that

were obsolete or made certain parts of the code ineffective. With this update,
the mentioned flags have been removed from the spec file. (BZ#1037725)

• Prior to this update, the pam_pkcs11 packages in Red Hat Enterprise Linux 7

were missing two bug fixes present in pam_pkcs11 for Red Hat Enterprise Linux 6.
They were the bug fix for BZ#586422, which fixed argument parsing for the
pam_pkcs11 module, and the bug fix for BZ#625509, which updated pam_pkcs11 to no
longer display error messages when certain expected errors occurred. This update
adds the fixes for the mentioned bugs also for pam_pkcs11 in Red Hat Enterprise
Linux 7. (BZ#1039221)

• Previously, pam_pkcs11 required the module path name contained in the security

module database and the path name to the same module in the pam_pkcs11.conf file
to be identical and did not correctly handle configurations with two equivalent
but differently phrased path names, such as one path name containing the
"lib64/" directory and the other path name containing the "$LIB" variable. As a
consequence, pam_pkcs11 denied access to users authenticating with a smart card
when the mentioned path names were not phrased identically. With this update,
the process through which pam_pkcs11 compares the path names has been modified,
and users can now authenticate themselves using a smart card as expected.
(BZ#1061222)

Users of pam_pkcs11 are advised to upgrade to these updated packages, which fix
these bugs.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64

Fixes

• BZ - 1037725 - pam_pkcs11: compile with fortify hardening
• BZ - 1039221 - RHEL 7 pam_pkcs11 is missing 2 fixes in RHEL 6
• BZ - 1061222 - pam_pkcs11 could be a little more forgiving of minor differences in secmod versus pam_pkcs11.conf

CVEs

(none)

References

(none)