RHBA-2018:2306 - Bug Fix Advisory

Topic

Updated pki-core packages that fix several bugs and add one enhancement are now available for Red Hat Enterprise Linux 7.

Description

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

This update fixes the following bugs:

• Previously, Certificate System insufficiently validated values set in iPAddressName fields. If an invalid value was set, the server incorrectly issued certificates that contained this value. With this update, Certificate System validates iPAddressName values in profile configurations according to the context, such as Subject Alternative Name (SAN) or name constraints extensions. As a result, the server no longer issues certificates with invalid iPAddressName values. (BZ#1553068)
• Previously, if the auth.instance_id parameter was not set in a profile used with the ProfileSubmitCMCSimple servlet, requesting a certificate failed and Certificate System logged a NullPointerException error. The problem has been fixed. As a result, requesting a certificate now works correctly when auth.instance_id is not set in a profile with the ProfileSubmitCMCSimple servlet. (BZ#1574848)
• Previously, Certificate Management over CMS (CMC) requests authenticated through a Shared Token did not supply a default subjectDN entry. Instead, the certificate signing request (CSR) provided the certificate subjectDN. However, this entry in the CSR can be different from the distinguished name (DN) of the requesting user's LDAP record. As a consequence, the subjectDN in the certificate could be incorrect. With this update, Certificate System adds the default subjectDN from the user's LDAP record. As a result, the subjectDN in the issued certificate matches the requesting user. (BZ#1593585)
• Previously, Certificate System did not contain audit log entries for failed Certificate Management over CMS (CMC) SharedToken authentication scenarios. As a consequence, these events were not logged in the audit log. This update adds the missing audit events. As a result, failed CMC SharedToken authentication events are now logged in the audit log. (BZ#1594128)
• Previously, the CONFIG_ROLE audit event contained line breaks when a role user's certificate was updated using the "pki cli" command. However, the AuditVerify utility treated each line as a separate audit entry. As a consequence, the utility failed when such CONFIG_ROLE events existed in the audit log. This update removes the line breaks from such CONFIG_ROLE event. As a result, AuditVerify can now correctly verify the mentioned event entry. (BZ#1595606)
• Previously, administrators were not able to control if Certificate System overrides the subjectDN encoding in the certificate signing request (CSR) with the encoding set by the system. This update adds the "policyset.<policyset>.<#>.default.params.useSysEncoding" parameter to the UserSubjectNameDefault entry of the profile. Setting the parameter to "true" overrides the subjectDN with the system default order or the order set in the "X500Name.directoryStringEncodingOrder" parameter. By default, "policyset.<policyset>.<#>.default.params.useSysEncoding" is set to false. As a result, administrators can now control if Certificate System overrides the subject DN encoding. (BZ#1596551)

In addition, this update adds the following enhancement:

• This update enhances Certificate System to automatically apply ECC profiles when setting up a new root CA with ECC profiles using the *pkispawn* utility. As a result, administrators no longer have to set the profile overwrite parameters for ECC certificates as a workaround in the configuration file passed to *pkispawn* when setting up a root CA. (BZ#1596525)

Users of pki-core are advised to upgrade to these updated packages, which fix these bugs and add this enhancement.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.5 x86_64
• Red Hat Enterprise Linux Server - AUS 7.7 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.5 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.5 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.5 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.7 x86_64
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux EUS Compute Node 7.7 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux EUS Compute Node 7.5 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.7 ppc64le
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.7 x86_64
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1553068 - Using a Netmask produces an odd entry in a certifcate [rhel-7.5.z]
• BZ - 1574848 - servlet profileSubmitCMCSimple throws NPE [rhel-7.5.z]
• BZ - 1593585 - Need proper default subjectDN for CMC request authenticated through SharedToken [rhel-7.5.z]
• BZ - 1594128 - CMC: Audit Events needed for failures in SharedToken scenario's [rhel-7.5.z]
• BZ - 1595606 - AuditVerify failure due to line breaks [rhel-7.5.z]
• BZ - 1596525 - Address ECC profile overrides [rhel-7.5.z]

CVEs

(none)

References

(none)