RHBA-2015:1317 - Bug Fix Advisory

Topic

Updated openscap packages that fix several bugs and add various enhancements are
now available for Red Hat Enterprise Linux 6.

Description

OpenSCAP is an open source project, which enables integration of the Security
Content Automation Protocol (SCAP) line of standards. SCAP is a line of
standards managed by the National Institute of Standards and Technology (NIST).
It was created to provide a standardized approach to maintaining the security of
enterprise systems, such as automatically verifying presence of patches,
checking system security configuration settings, and examining systems for signs
of compromise.

The openscap packages have been upgraded to upstream version 1.0.10,
which provides a number of bug fixes and enhancements over the previous
version. Updated version is fully API/ABI compatible with 1.0.x version
which has been certified by the National Institute of Standards and Technology
(NIST). (BZ#1152599)

This update also fixes the following bugs:

• Previously, the has_extended_acl feature was missing in the scripts that build

OpenSCAP, which caused the OpenSCAP auditing tool to be unable to assess
extended file system properties. This update fixes the build process of OpenSCAP
to include has_extended_acl, and OpenSCAP is now again able to assess extended
file system properties as intended. (BZ#1036741)

• When the Extensible Configuration Checklist Description Format (XCCDF)

input content included an instruction to use a certain XCCDF variable with an
undefined variable value, the OpenSCAP scanner could crash. With this update,
the NULL pointer causing this bug is handled correctly when binding the XCCDF
value to the OVAL variable, and the security scan now proceeds smoothly.
(BZ#1092013)

• The OVAL standard requires that the var_check content XML attribute be

included within any XML elements that have the var_ref attribute, which the
OpenSCAP scanner did not always observe. As a consequence, the schematron
validation of OVAL results returned a warning message to the user. The OVAL
module has been fixed to export var_check explicitly whenever exporting var_ref,
and the schematron validation now passes as expected. (BZ#1192428)

In addition, this update adds the following enhancement:

• To keep the installed package set to the minimum, the number of package

dependencies of the OpenSCAP auditing tool has been reduced. With this update,
the oscap tool is shipped within the newly created openscap-scanner package and
the openscap-utils package remains to include miscellaneous tools. Users are
advised to remove openscap-utils, if they no longer need other utilities except
for the scanner. (BZ#1115114)

Users of openscap are advised to upgrade to these updated packages, which fix
these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata relevant
to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 6 x86_64
• Red Hat Enterprise Linux Server 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 6 i386
• Red Hat Enterprise Linux Workstation 6 x86_64
• Red Hat Enterprise Linux Workstation 6 i386
• Red Hat Enterprise Linux Desktop 6 x86_64
• Red Hat Enterprise Linux Desktop 6 i386
• Red Hat Enterprise Linux for IBM z Systems 6 s390x
• Red Hat Enterprise Linux for Power, big endian 6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 x86_64
• Red Hat Enterprise Linux Server from RHUI 6 i386
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 6 s390x

Fixes

• BZ - 1036741 - file probe: missing has_extended_acl entity
• BZ - 1115114 - RFE: Reduce OpenSCAP scanner footprint
• BZ - 1192428 - STIG, OVAL validating: var_check has been supplied, var_ref missing

CVEs

(none)

References

(none)