RHBA-2015:2121 - Bug Fix Advisory

Topic

Updated nss packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 7.

Description

Network Security Services (NSS) is a set of libraries designed to support cross-platform development of security-enabled client and server applications.

Notably, this update fixes the following bugs:

• Querying an LDAP over SSL (LDAPS) server previously failed when the "ssf=256" parameter defining the security strength factor (SSF) was used in the OpenLDAP configuration. The following error message was recorded in the /var/log/slapd.log file:

slapd[2030]: conn=1001 op=0 RESULT tag=97 err=13
text=stronger confidentiality required

NSS cipher order has been modified to prefer ciphers that use 256-bit keys over ciphers that use 128-bit bulk encryption ciphers. As a result, OpenLDAP configurations with "ssf=256" no longer cause the mentioned error. (BZ#1195766)

• Following a prior security update for Windows Server 2012 R2, multiple NSS-enabled applications, including ldapsearch and python-ldap, failed Transport Layer Security (TLS) negotiation on this system and did not work properly. This update modifies the signature algorithms sent as a part of the TLS 1.2 handshake so that the affected applications work as expected with Windows Server 2012 R2. (BZ#1212286)
• The RSA_WITH_NULL_SHA_256, RSA_WITH_NULL_SHA, and RSA_WITH_NULL_MD5 ciphers were previously missing from Red Hat Enterprise Linux 7 systems with the 3.18.0 or 3.19.1 version of the nss packages installed. Consequently, it was not possible to connect to servers using these ciphers. A patch has been applied to fix this problem, and the mentioned NULL ciphers can now be used as expected on Red Hat Enterprise Linux 7 systems. (BZ#1245627)

In addition, this update adds the following enhancements:

• Applications using protocol versions that NSS enables by default now additionally support the TLS version 1.1 and TLS version 1.2 protocols. (BZ#1171318)
• Applications that use the default NSS cipher list now support connections to servers that use Elliptic Curve Digital Signature Algorithm (ECDSA) certificates. (BZ#1059670)
• Applications that use the default NSS cipher list now support connections to servers that require the Elliptic Curve Diffie-Hellman Ephemeral (ECDHE) key exchange. (BZ#1202494)

Users of nss are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux Server from RHUI 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.2 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1059670 - Default cipher ordering doesn't include ECDSA ciphers
• BZ - 1123435 - Flaws in test script and conditional compile for disabling SSL2 and export suites support
• BZ - 1200898 - Rebase nss to 3.18 for Firefox 38 ESR [RHEL7.1]
• BZ - 1202494 - ECDHE key exchange not enabled by NSS_SetDomesticPolicy()
• BZ - 1215751 - Need to support SHA384 TLS cipher suites
• BZ - 1222074 - Compile nss/cmd/listsuites/listsuites.c command
• BZ - 1228913 - Rebase to nss-3.19.1 for CVE-2015-4000 [RHEL-7.1]

CVEs

(none)

References

• http://www.redhat.com/security/updates/classification/#normal