RHBA-2018:3195 - Bug Fix Advisory

Topic

An update for pki-core is now available for Red Hat Enterprise Linux 7.

Description

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.6 Release Notes linked from the References section.

Users of pki-core are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1538311 - Using a Netmask produces an odd entry in a certifcate
• BZ - 1540440 - CMC: Audit Events needed for failures in SharedToken scenario's
• BZ - 1540789 - Make sslget aware of TLSv1_2 ciphers
• BZ - 1544843 - ExternalCA: Installation failed during csr generation with ecc
• BZ - 1545388 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken
• BZ - 1545979 - [MAN] Add --skip-configuration and --skip-installation into pkispawn man page.
• BZ - 1546708 - Console: Adding ACL from pki-console gives StringIndexOutOfBoundsException (RHEL)
• BZ - 1548124 - CMCAuth throws org.mozilla.jss.crypto.TokenException: Unable to insert certificate into temporary database
• BZ - 1549632 - Not able to generate certificate request with ECC using pki client-cert-request
• BZ - 1550739 - Need ECC-specific Enrollment Profiles for standard conformance
• BZ - 1550742 - Address ECC profile overrides
• BZ - 1550786 - Permit additional FIPS ciphers to be enabled by default for RSA . . .
• BZ - 1557569 - Re-base pki-core from 10.5.1 to latest upstream 10.5.x (RHEL)
• BZ - 1562423 - SAN in internal SSL server certificate in pkispawn configuration step
• BZ - 1562841 - servlet profileSubmitCMCSimple throws NPE
• BZ - 1567910 - IPA install with external-CA is failing when FIPS mode enabled.
• BZ - 1568615 - ECC installation for non CA subsystems needs improvement
• BZ - 1570916 - [MAN] Missing Man pages for tools CMCRequest, CMCResponse, CMCSharedToken (typos)
• BZ - 1572432 - AuditVerify failure due to line breaks
• BZ - 1580394 - CMC CRMF requests result in InvalidKeyFormatException when signing algorithm is ECC
• BZ - 1585866 - CRMFPopClient tool - should allow option to do no key archival
• BZ - 1588655 - Cert validation for installation with external CA cert
• BZ - 1592961 - Need proper default subjectDN for CMC request authenticated through SharedToken
• BZ - 1593805 - Better understanding of NSS_USE_DECODED_CKA_EC_POINT for ECC
• BZ - 1596629 - ipa-replica-install --setup-kra broken on DL0 with latest version
• BZ - 1601071 - Certificate generation happens with partial attributes in CMCRequest file
• BZ - 1601569 - CC: Enable all config audit events
• BZ - 1608375 - CMC Revocations throws exception with same reqIssuer & certissuer

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.6_release_notes/index