RHBA-2019:0168 - Bug Fix Advisory

Topic

Updated pki-core packages that fix several bugs and add one enhancement are now available for Red Hat Enterprise Linux 7.

Description

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

This update fixes the following bugs:

• Previously, Certificate System did not contain audit events if the system acted as a client to other subsystems or to the LDAP server. As a consequence, the server did not record any events in this situation. This update adds the CLIENT_ACCESS_SESSION_ESTABLISH_FAILURE, CLIENT_ACCESS_SESSION_ESTABLISH_SUCCESS, and CLIENT_ACCESS_SESSION_TERMINATED events to Certificate System. As a result, Certificate System records these events when acting as a client. (BZ#1632116)
• A previous version of Certificate System added a feature to enforce TLS client authentication when authenticating through CMCAuth. However, certain older applications do not support TLS client authentication and failed to connect to Certificate System. This update adds the bypassClientAuth configuration parameter to the /var/lib/pki/pki-instance_name/ca/conf/CS.cfg file. As a result, administrators can now set this parameter to "true" to disable client authentication if not supported by certain applications. (BZ#1633104)
• Previously, the Certificate System REST API did not filter out plain password values. As a consequence, passwords were visible in clear text in log files. With this update, the server replaces password attribute values with "(sensitive)". As a result, clear text passwords are no longer visible in logs. (BZ#1645263)
• The CMCRequest utility in Certificate System requires the private key IDs, the CRMFPopClient and PKCS10Client utilities show in their output. With this update, CRMFPopClient and PKCS10Client additionally write the key IDs into a file in case the administrator wants to run CMCRequest later. As a result, it is no longer necessary to manually track the IDs in this scenario. This update also changes the following profile names:
• caECFullCMCSelfSignedCert.cfg to caECFullCMCSharedTokenCert.cfg
• caFullCMCSelfSignedCert.cfg to caFullCMCSharedTokenCert.cfg

Additionally, this update changes the constraint name CMCSelfSignedSubjectNameConstraint to CMCSharedTokenSubjectNameConstraint. (BZ#1655951)

• Previously, the pki-core package installed multiple web.xml files. To configure a HTTP session timeout, it was required to set the session-timeout parameter in each of these files. To simplify the configuration, the session-timeout parameter has been removed from the files installed by the pki-core package and is now available only in the /etc/pki/<instance_name>/web.xml file. As a result, administrators need only to configure the HTTP session timeout in this one file. (BZ#1659939)
• Previously, when a CA or OCSP subsystem that was configured with OCSP checking was restarted, a self test in Certificate System checked the validity of the subsystem certificates in a subsystem. Due to the OCSP checking method, the subsystem failed to start? With this update, the server performs a simpler set of certificate validity tests which do not cause the mentioned problem. As a result, restarting a CA or OCSP subsystem with OCSP checking works correctly. If OCSP checking is not configured and you require the full certificate validity tests, you can restore the old behavior by setting "selftests.plugin.SystemCertsVerification.FullCAandOCSPVerify=true" in the CS.cfg file. (BZ#1657922)

In addition, this update adds the following enhancement:

• Previously, the pkispawn utility reported a name collision error when installing a Certificate System subsystem on a server with an existing Certificate System log directory structure. With this enhancement, Certificate System reuses the existing log directory structure to preserve logs of previous installations. (BZ#1645429)

Users of pki-core are advised to upgrade to these updated packages, which fix these bugs and add these enhancements

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 7.6 x86_64
• Red Hat Enterprise Linux Server - AUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 7.6 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Power, big endian - Extended Update Support 7.6 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 7.6 ppc64le
• Red Hat Enterprise Linux Server - TUS 7.6 x86_64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support (for IBM z Systems) 7 s390x
• Red Hat Enterprise Linux for ARM 64 7 aarch64
• Red Hat Enterprise Linux for Power 9 7 ppc64le
• Red Hat Enterprise Linux EUS Compute Node 7.6 x86_64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 7.6 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 7.6 x86_64
• Red Hat Enterprise Linux for IBM System z (Structure A) 7 s390x
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, big endian 7 ppc64
• Red Hat Enterprise Linux Server - Extended Life Cycle Support for IBM Power, little endian 7 ppc64le

Fixes

• BZ - 1632120 - Unsupported RSA_ ciphers should be removed from the default ciphers list [rhel-7.6.z]
• BZ - 1632615 - Permit certain SHA384 FIPS ciphers to be enabled by default for RSA and ECC . . . [rhel-7.6.z]
• BZ - 1633104 - CMC: add config to allow non-clientAuth [rhel-7.6.z]
• BZ - 1636490 - Installation of CA using an existing CA fails [rhel-7.6.z]
• BZ - 1643879 - CC: Identify version/release of pki-ca, pki-kra, pki-ocsp, pki-tks, and pki-tps remotely [RHEL] [rhel-7.6.z]
• BZ - 1643880 - PKI subsystem process is not shutdown when there is no space on the disk to write logs [rhel-7.6.z]
• BZ - 1645262 - pkidestroy may not remove all files [rhel-7.6.z]
• BZ - 1645263 - Auth plugins leave passwords in the access log and audit log using REST [rhel-7.6.z]
• BZ - 1645429 - pkispawn fails due to name collision with /var/log/pki/<instance> [rhel-7.6.z]
• BZ - 1655951 - CC: tools supporting CMC requests output keyID needs to be captured in file [rhel-7.6.z]
• BZ - 1656297 - Unable to install with admin-generated keys [rhel-7.6.z]
• BZ - 1657922 - CC: CA/OCSP startup fail on SystemCertsVerification if enableOCSP is true [rhel-7.6.z]
• BZ - 1659939 - CC: Simplifying Web UI session timeout configuration [rhel-7.6.z]

CVEs

(none)

References

(none)