RHBA-2017:2110 - Bug Fix Advisory

Topic

An update for pki-core is now available for Red Hat Enterprise Linux 7.

Description

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.4 Release Notes linked from the References section.

Users of pki-core are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1282504 - Installing pki-server in container reports scriptlet failed, exit status 1
• BZ - 1303683 - dogtag should support GSSAPI based auth in conjuction with FreeIPA
• BZ - 1305993 - Add profile component that copies CN to SAN
• BZ - 1316653 - pki ca-cert-request-submit fails presumably because of missing authentication even if it should not require any
• BZ - 1325071 - add options to enable/disable cert or crl publishing.
• BZ - 1330800 - Failed to start pki-tomcatd Service ("ipa-cacert-manage renew" failed?)
• BZ - 1372052 - Unable to search certificate requests using the latest request ID
• BZ - 1375347 - Typo in comment line of UserPwdDirAuthentication.java
• BZ - 1376226 - IPA replica-prepare failed with error "Profile caIPAserviceCert Not Found"
• BZ - 1378275 - two-step externally-signed CA installation fails due to missing AuthorityID
• BZ - 1378277 - Spurious host authority entries created
• BZ - 1378527 - Miscellaneous Minor Changes
• BZ - 1381084 - KRA installation failed against externally-signed CA with partial certificate chain
• BZ - 1386303 - cannot extract generated private key from KRA when HSM is used.
• BZ - 1386371 - Remove xenroll.dll from pki-core
• BZ - 1386424 - Fix packaging duplicates of classes in multiple jar files
• BZ - 1388622 - FreeIPA to Dogtag permission mapping plugin
• BZ - 1392068 - [RFE] add express archivals and retrievals from KRA
• BZ - 1394309 - Rebase pki-core to 10.4.x in RHEL-7.4
• BZ - 1395817 - Unable to install subordinate CA with HSM in FIPS mode
• BZ - 1399862 - Dogtag 10.3.9 Man Pages
• BZ - 1400149 - pkispawn fails to create CA subsystem on FIPS enabled system
• BZ - 1411428 - Unable to create a CA clone in FIPS
• BZ - 1412211 - Unable to set up KRA in FIPS
• BZ - 1412681 - update to 7.3 IPA with otpd bugfixes, tomcat will not finish start, hangs
• BZ - 1413136 - Problem with default AJP hostname in IPv6 environment.
• BZ - 1437591 - cli authentication using expired cert throws an exception
• BZ - 1437602 - non-CA cli looks for CA in the instance during a request
• BZ - 1445088 - profile modification cannot remove existing config parameters
• BZ - 1445519 - CA Server installation with HSM fails
• BZ - 1446364 - pkispawn returns before tomcat is ready
• BZ - 1446874 - Missing ClientIP and ServerIP in audit log when pki CLI terminates SSL connection
• BZ - 1446875 - Session timeout for PKI console (RHEL)
• BZ - 1447080 - CC: CMC: allow enrollment key signed (self-signed) CMC with identity proof
• BZ - 1447144 - CA brought down during separate KRA instance creation
• BZ - 1447762 - pkispawn fails occasionally with this failure ACCESS_SESSION_ESTABLISH_FAILURE
• BZ - 1448203 - CAInfoService: retrieve KRA-related values from the KRA
• BZ - 1448204 - pkispawn of clone install fails with InvalidBERException
• BZ - 1448521 - kra unable to extract symmetric keys generated on thales hsm
• BZ - 1450143 - CA installation with HSM in FIPS mode fails
• BZ - 1452250 - Inconsistent CERT_REQUEST_PROCESSED event in ConnectorServlet.
• BZ - 1452340 - Ensuring common audit log correctness
• BZ - 1452344 - Adding serial number into CERT_REQUEST_PROCESSED audit event.
• BZ - 1452617 - Unable to create IPA Sub CA
• BZ - 1454471 - Enabling all subsystems on startup
• BZ - 1454603 - Unable to install IPA server due to pkispawn error
• BZ - 1455617 - Key recovery on token fails because key record is not marked encrypted
• BZ - 1456597 - Certificate import using pki client-cert-import is asking for password when already provided
• BZ - 1456940 - Build failure due to Pylint issues
• BZ - 1458043 - Key recovery on token fails with invalid public key error on KRA
• BZ - 1458047 - change the way aes clients refer to aes keysets
• BZ - 1458055 - dont reuse IVs in the CMC code
• BZ - 1458379 - Upgrade script for keepAliveTimeout parameter
• BZ - 1458429 - client-cert-import --ca-cert should import CA cert with trust bits "CT,C,C"
• BZ - 1460028 - In keywrap mode, key recovery on KRA with HSM causes KRA to crash
• BZ - 1461533 - Unable to find keys in the p12 file after deleting the any of the subsystem certs from it

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/Red_Hat_Enterprise_Linux/7/html/7.4_Release_Notes/index.html