RHBA-2017:2575 - Bug Fix Advisory

Topic

Updated pki-core packages that fix two bugs and add various enhancements are now available for Red Hat Enterprise Linux 7.

Description

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

This update fixes the following bugs:

• Red Hat Enterprise Linux 7.4 introduced a configurable access banner - a custom message to be displayed in the PKI console at the start of every secure session. The contents of this banner were not validated, which could cause a "JAXBUnmarshalException" error if the message contained invalid UTF-8 characters. With this update, the contents of the banner file are validated both on server startup and on client requests. If the file is found to contain invalid UTF-8 characters on server startup, the server will not start. If invalid characters are found when a client requests the banner, the server will return an error message and not send the banner to the client. (BZ#1463350)
• Previously, attempting to perform a symmetric key changeover with the master key on a HSM token failed with an error reported by the TPS server. This update fixes the way the master key on a HSM is used to calculate the new key set, allowing the TPS to successfully upgrade a token key set when the master resides on a HSM. The fix is currently verified with the G&D SmartCafe 6.0 HSM. (BZ#1469439)

In addition, this update adds the following enhancements:

• This update adds support for CMC-based system certificate requests, and adds the following new CMC-based system enrollment profiles:
• caCMCauditSigningCert.cfg
• caCMCcaCert.cfg
• caCMCkraStorageCert.cfg
• caCMCkraTransportCert.cfg
• caCMCocspCert.cfg
• caCMCserverCert.cfg
• caCMCsubsystemCert.cfg

(BZ#1469446)

• This update adds an SSL client authentication certificate check against the CMC signer for CMC requests. (BZ#1469447)
• This update allows the CA to process CMC renewal requests signed by a previously issued signing certificate. The implementation uses the caFullCMCUserSignedCert with the UniqueKeyConstraint enhanced profile constraint, which has also been updated to disallow renewal of a key shared by a revoked certificate. Additionally, it preserves the origNotAfter attribute of the most recent certificate that shares the same key in the request, which allows the attribute to be used by the RenewGracePeriodConstraint. If there is an existing origNotAfter attribute, it is not overwritten in this process in order to not interfere with the existing "renewal by serial" flow. Additionally, the caFullCMCUserSignedCert.cfg profile has been updated to contain both the UniqueKeyConstraint and the RenewGracePeriodConstraint, which must be placed in the correct order. Note that by default, the allowSameKeyRenewal parameter is set to true in the UniqueKeyConstraint. (BZ#1469449)
• With this enhancement, PKI now complies with RFC 5272 - Certificate Management over CMS (CMC). The following CMC control attributes have been implemented:
• id-cmc-identityProofV2
• id-cmc-identification
• id-cmc-popLinkWitnessV2
• id-cmc-encryptedPOP
• id-cmc-decryptedPOP
• id-cmc-regInfo
• id-cmc-responseInfo
• id-cmc-statusInfoV2

As a result, PKI now supports the following features in CMC with respect to certificate enrollment, renewal, and revocation:

• User-signed and self-signed proof of identity
• Signing and encryption keys proof of possession
• ID/POP linking

Additionally, the "CMCRequest" and "CMCResponse" utilities have been updated to work with these new features. (BZ#1472615)

Users of pki-core are advised to upgrade to these updated packages, which fix these bugs and add these enhancements.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.4 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.4 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.4 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.4 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - TUS 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.4 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.4 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.4 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1469437 - subsystem-cert-update command lacks --cert option
• BZ - 1469446 - CC: need CMC enrollment profiles for system certificates
• BZ - 1469447 - CC: CMC: check HTTPS client authentication cert against CMC signer
• BZ - 1472617 - CMC: cmc.popLinkWitnessRequired=false would cause error
• BZ - 1472619 - Platform Dependent Python Import

CVEs

(none)

References

(none)