RHBA-2022:7563 - Bug Fix Advisory

Topic

An update for scap-security-guide is now available for Red Hat Enterprise Linux 8.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.7 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

• BZ - 2032403 - openscap cis_server_level1 benchmark list mount option requirement for /var/tmp but does not require separate /var/tmp
• BZ - 2058203 - Update content in alignment to CIS RHEL8 Benchmark v2.0.0
• BZ - 2064696 - The /etc/tmux.conf file created has root 600 permissions, which delays the user login
• BZ - 2070564 - Rebase SSG to the latest upstream version in RHEL 8.7
• BZ - 2077531 - Rule xccdf_org.ssgproject.content_rule_chronyd_run_as_chrony_user enforces setting "-u chrony" which is overkill
• BZ - 2078974 - DISA STIG oscap profile results in a rsyslog.conf which is configured for tcp forwarding without queues
• BZ - 2079241 - Update RHEL8 DISA STIG profile to V1R6
• BZ - 2083109 - issues with xccdf_org.ssgproject.content_rule_sudo_custom_logfile rule and remediation
• BZ - 2109602 - rhel8-script-stig.sh incorrectly defines eth_interface_list as a string then attempts to use it as an array
• BZ - 2112937 - Update RHEL8 DISA STIG profile to V1R7
• BZ - 2117192 - The new enable_authselect SCAP rule needs some tweaking

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.7_release_notes/index