RHBA-2019:2228 - Bug Fix Advisory

Topic

An update for pki-core is now available for Red Hat Enterprise Linux 7.

Description

The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System.

For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.7 Release Notes linked from the References section.

Users of pki-core are advised to upgrade to these updated packages.

Solution

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux Server 7 x86_64
• Red Hat Enterprise Linux Workstation 7 x86_64
• Red Hat Enterprise Linux Desktop 7 x86_64
• Red Hat Enterprise Linux for IBM z Systems 7 s390x
• Red Hat Enterprise Linux for Power, big endian 7 ppc64
• Red Hat Enterprise Linux for Scientific Computing 7 x86_64
• Red Hat Enterprise Linux for Power, little endian 7 ppc64le

Fixes

• BZ - 1372056 - pkidestroy may not remove all files
• BZ - 1468348 - [RFE] Offline Certificate Renewal System
• BZ - 1554055 - Permit certain SHA384 FIPS ciphers to be enabled by default for RSA and ECC . . .
• BZ - 1578389 - Unsupported RSA_ ciphers should be removed from the default ciphers list
• BZ - 1616134 - Unable to install with admin-generated keys
• BZ - 1617894 - Auth plugins leave passwords in the access log and audit log using REST
• BZ - 1624097 - CC: Identify version/release of pki-ca, pki-kra, pki-ocsp, pki-tks, and pki-tps remotely [RHEL]
• BZ - 1628410 - CMC: add config to allow non-clientAuth
• BZ - 1633422 - Rebase pki-core from 10.5.9 to 10.5.16 (RHEL)
• BZ - 1633761 - Installation of CA using an existing CA fails
• BZ - 1638379 - PKI startup initialization process should not depend on LDAP operational attributes
• BZ - 1639710 - PKI subsystem process is not shutdown when there is no space on the disk to write logs
• BZ - 1641119 - CC: CA/OCSP startup fail on SystemCertsVerification if enableOCSP is true
• BZ - 1644769 - pkispawn fails due to name collision with /var/log/pki/<instance>
• BZ - 1653863 - CC: tools supporting CMC requests output keyID needs to be captured in file
• BZ - 1658293 - CC: Simplifying Web UI session timeout configuration
• BZ - 1666853 - CC: unable to verify cert before import

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.7_release_notes/index