Issued:
2021-11-09
Updated:
2021-11-09

RHBA-2021:4460 - Bug Fix Advisory

Synopsis

crypto-policies bug fix and enhancement update

Type/Severity

Bug Fix Advisory

Red Hat Insights patch analysis

Identify and remediate systems affected by this advisory.

View affected systems

Topic

An update for crypto-policies is now available for Red Hat Enterprise Linux
8.

Description

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

  • Red Hat Enterprise Linux for x86_64 8 x86_64
  • Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6 x86_64
  • Red Hat Enterprise Linux Server - AUS 8.6 x86_64
  • Red Hat Enterprise Linux for IBM z Systems 8 s390x
  • Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6 s390x
  • Red Hat Enterprise Linux for Power, little endian 8 ppc64le
  • Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6 ppc64le
  • Red Hat Enterprise Linux Server - TUS 8.6 x86_64
  • Red Hat Enterprise Linux for ARM 64 8 aarch64
  • Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6 aarch64
  • Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6 ppc64le
  • Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6 x86_64

Fixes

  • BZ - 1898986 - rpm verification fails because nss.config is generated as a file and not a symlink like it is defined in the rpm spec
  • BZ - 1925104 - Camellia ciphers are still enabled in kerberos while docs say they are disabled everywhere
  • BZ - 1940998 - Need to add new signature algorithms for NSS
  • BZ - 1946522 - DTLS1.0 connections are allowed in DEFAULT crypto-policy in openssl [rhel-8]
  • BZ - 1954343 - update-crypto-policies does not respect pre-generated policy when local.d policy exists
  • BZ - 1960266 - rebase crypto-policies to a version with scoped policies support

CVEs

(none)

Red Hat Enterprise Linux for x86_64 8

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
x86_64
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.6

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
x86_64
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux Server - AUS 8.6

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
x86_64
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux for IBM z Systems 8

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
s390x
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.6

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
s390x
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux for Power, little endian 8

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
ppc64le
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.6

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
ppc64le
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux Server - TUS 8.6

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
x86_64
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux for ARM 64 8

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
aarch64
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.6

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
aarch64
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.6

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
ppc64le
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.6

SRPM
crypto-policies-20210617-1.gitc776d3e.el8.src.rpm SHA-256: 5cc0a73e1f16f5a8dac60bce59873207348b7e07a307f72fa8976b0ca285b40b
x86_64
crypto-policies-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: f8f0cce0bebd3344d6cf3f26849b101d718384e8c4bb60a9c718efb34fc20ba6
crypto-policies-scripts-20210617-1.gitc776d3e.el8.noarch.rpm SHA-256: 2770764a1bb3926bbe64a3c56f459fd0615591113c060efa088d11e1e9b9c29a

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.