RHBA-2016:2396 - Bug Fix Advisory

Topic

An update for pki-core is now available for Red Hat Enterprise Linux 7.

Description

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.3 Release Notes linked from the References section.

Users of pki-core are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.3 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.3 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.3 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.3 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.3 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.3 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.3 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1082663 - CA not start during ipa server install in pure IPv6 env
• BZ - 1161717 - Fix coverity warnings for 'tkstool'
• BZ - 1162173 - ipa-server-install: Cannot handle double hyphen "--" in hostname
• BZ - 1257518 - Running ipa-server-install produces 400 Bad Request in dogtag's access log
• BZ - 1266987 - Runtime dependency on python-nss is missing
• BZ - 1277691 - ipa-cacert-manage renew failed with validity out of range
• BZ - 1285789 - Configuration files /usr/lib/systemd/system/pki-* are marked executable. Please remove executable permission bits.
• BZ - 1289323 - [RFE] Provide the user the ability to import their own CA certificate with private key
• BZ - 1292143 - Rebase pki-core to 10.3.x
• BZ - 1301546 - pkispawn ignores 3rd party CA certs in pki_clone_pkcs12_path
• BZ - 1302127 - After uninstalling all KRA instances, dogtag still returns info that KRA instance exists somewhere
• BZ - 1302134 - Too generic selftest error messages
• BZ - 1302136 - [RFE] provide separate cipher lists for CS instances acting as client and server
• BZ - 1302142 - pkispawn overwrites files when adding subsystem to existing instance
• BZ - 1303156 - pki.client.PKIConnection should ignore env vars such as http_proxy
• BZ - 1303175 - Installation: allow customization of cipher list before actual installation
• BZ - 1305622 - Rename DRMTool --> KRATool
• BZ - 1305769 - pki-server still requires perl
• BZ - 1305992 - Database upgrade script to add issuerName attribute to all cert entries
• BZ - 1308752 - Unable to configure KRA subsystem, failed with error Error in creating admin user: java.io.IOException: Invalid Request"
• BZ - 1317856 - Replica install fails with external-ca IPA master
• BZ - 1325798 - pki-tools in RHEL7 repo doesn't allow RHCS cert signing
• BZ - 1327683 - Add options to trim old CRLs
• BZ - 1347466 - Consider overriding '/usr/sbin/alternatives' for PKI java
• BZ - 1348976 - freeipa fails to start correctly after pki-core update on upgraded system
• BZ - 1349710 - Upgraded CA lacks ca.sslserver.certreq in CS.cfg
• BZ - 1350983 - Installation: subsystem certs could have notAfter beyond CA signing cert in case of external or existing CA
• BZ - 1351295 - Dogtag 10.3.4: Miscellaneous Enhancements
• BZ - 1353245 - Dogtag 10.3.5: Miscellaneous Enhancements
• BZ - 1353927 - pkispawn calls dnsdomainname even if it does not rpm-require hostname
• BZ - 1357075 - pki client-cert-import --trust option does not apply the specified trust bits
• BZ - 1358462 - pki pkcs12-cert-del shows a successfully deleted message when a wrong nickname is provided
• BZ - 1359196 - pki_ca_signing_token when not specified does not fallback to pki_token_name value
• BZ - 1360525 - CA subsystem OSCP responder fails when LWCAs are not used
• BZ - 1363608 - Kra-selftest behavior is not as expected
• BZ - 1364071 - Errors noticed during ipa server upgrade.
• BZ - 1364567 - CA Agent certificate list is not sorted by serial number in migration case
• BZ - 1364867 - Lightweight CA GET {id}/chain returns bogus PEM data
• BZ - 1366353 - Dogtag 10.3.3-X: Miscellaneous Enhancements
• BZ - 1366578 - CSR Generated is not of correct format hence unable to decode
• BZ - 1367140 - NO_SUCH_USER and entryUSN error messages after CA installation
• BZ - 1369640 - Host CA's certificate and key are deleted if LWCA entry deleted
• BZ - 1373178 - Lightweight CA signing cert not revoked upon deletion

CVEs

(none)

References

(none)