RHBA-2021:4460 - Bug Fix Advisory

Topic

An update for crypto-policies is now available for Red Hat Enterprise Linux
8.

Description

For detailed information on changes in this release, see the Red Hat
Enterprise Linux 8.5 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 1898986 - rpm verification fails because nss.config is generated as a file and not a symlink like it is defined in the rpm spec
• BZ - 1925104 - Camellia ciphers are still enabled in kerberos while docs say they are disabled everywhere
• BZ - 1940998 - Need to add new signature algorithms for NSS
• BZ - 1946522 - DTLS1.0 connections are allowed in DEFAULT crypto-policy in openssl [rhel-8]
• BZ - 1954343 - update-crypto-policies does not respect pre-generated policy when local.d policy exists
• BZ - 1960266 - rebase crypto-policies to a version with scoped policies support

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.5_release_notes/index