RHBA-2018:0925 - Bug Fix Advisory

Topic

An update for pki-core is now available for Red Hat Enterprise Linux 7.

Description

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.5 Release Notes linked from the References section.

Users of pki-core are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1404794 - Audit Log Signature verification failures
• BZ - 1446786 - PKCS12: upgrade to at least AES and SHA2 (FIPS)
• BZ - 1447145 - CMC: cmc.popLinkWitnessRequired=false would cause error
• BZ - 1452347 - CC: Replacing Random with SecureRandom.
• BZ - 1460764 - CC: CMC: check HTTPS client authentication cert against CMC signer
• BZ - 1461217 - CC: Auditing: ReqID usage inconsistency for CertStatusChangeRequestProcessedEvent and cert requests
• BZ - 1461524 - CC: Auditing: ROLE_ASSUME event recorded even though no privileged user access occurred
• BZ - 1463916 - Platform Dependent Python Import
• BZ - 1464549 - CC: Installation with CMC
• BZ - 1464591 - CC: need CMC enrollment profiles for system certificates
• BZ - 1466066 - CC: Secure removal of secret data storage
• BZ - 1466073 - subsystem-cert-update command lacks --cert option
• BZ - 1466486 - CMC plugin default change
• BZ - 1469169 - Weak ciphers (3DES) should not be enabled by default anymore
• BZ - 1473452 - Rebase pki-core to latest upstream 10.5.x release (RHEL)
• BZ - 1474658 - Missing CN in user signing cert would cause error in cmc user-signed
• BZ - 1479663 - pki-server-upgrade fails when upgrading from RHEL 7.1
• BZ - 1484359 - Lightweight CA key replication fails (regressions)
• BZ - 1486225 - ipa-replica-install --setup-kra broken on DL0
• BZ - 1486901 - client-cert-del CLI incorrectly asking for a valid port
• BZ - 1497920 - CMC: Missing CN causing NPE in CMCAuth
• BZ - 1498957 - pkidestroy does not work with nuxwdog
• BZ - 1499054 - CA cert without Subject Key Identifier causes issuance failure
• BZ - 1506819 - Incorrect SubjectID for CMC_SIGNED_REQUEST_SIG_VERIFY
• BZ - 1507088 - CA installation with HSM failed
• BZ - 1518096 - ExternalCA: Failures in ExternalCA when tried to setup with CMC signed certificates
• BZ - 1520277 - PR_FILE_NOT_FOUND_ERROR during pkispawn
• BZ - 1520526 - p12 admin certificate is missing when certificate is signed Externally
• BZ - 1523443 - HAProxy rejects OCSP responses due to missing nextupdate field
• BZ - 1525306 - CC: missing CMC request and response record
• BZ - 1532759 - pkispawn seems to be leaving our passwords in several different files after installation completes
• BZ - 1532867 - Inconsistent key ID encoding (RHEL)
• BZ - 1532933 - Installing subsystems with external CMC certificates in HSM environment shows import error
• BZ - 1535797 - ExternalCA: Failures when installed with hsm
• BZ - 1539125 - restrict default cipher suite to those ciphers permitted in fips mode
• BZ - 1539198 - Inconsistent CERT_REQUEST_PROCESSED outcomes.
• BZ - 1541526 - CMC: Revocation works with an unknown revRequest.issuer
• BZ - 1541853 - ProfileService: config values with backslashes have backslashes removed
• BZ - 1543242 - Regression in lightweight CA key replication

CVEs

(none)

References

• https://access.redhat.com/documentation/en-US/red_hat_enterprise_linux/7/html/7.5_release_notes/index.html