RHBA-2023:2869 - Bug Fix Advisory

Topic

An update for scap-security-guide is now available for Red Hat Enterprise Linux 8.

Description

For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.8 Release Notes linked from the References section.

Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for x86_64 - Extended Update Support 8.8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for IBM z Systems - Extended Update Support 8.8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for Power, little endian - Extended Update Support 8.8 ppc64le
• Red Hat Enterprise Linux Server - TUS 8.8 x86_64
• Red Hat Enterprise Linux for ARM 64 8 aarch64
• Red Hat Enterprise Linux for ARM 64 - Extended Update Support 8.8 aarch64
• Red Hat Enterprise Linux Server for Power LE - Update Services for SAP Solutions 8.8 ppc64le
• Red Hat Enterprise Linux for x86_64 - Update Services for SAP Solutions 8.8 x86_64

Fixes

• BZ - 2072444 - [SCAP] PCI-DSS Rsyslog log files related rules fails for Rsyslog 8 RainerScript syntax
• BZ - 2099394 - DISA STIG: SCAP kerberos related findings after realm join
• BZ - 2115343 - file_permissions_sshd_private_key is not aligned with DISA STIG benchmark
• BZ - 2116474 - DISA stig security profile creates botched network file
• BZ - 2118758 - sysctl_net_ipv4_conf_all_forwarding fails on GUI installation after STIG Ansible playbook
• BZ - 2119356 - audit_rules_usergroup_modification_shadow don't remediate existing audit rule
• BZ - 2151553 - Rules concerning audit check for content of specific files, and not /etc/audit/audit.rules ( ex xccdf_org.ssgproject.content_rule_audit_immutable_login_uids)
• BZ - 2152208 - The stig rule xccdf_org.ssgproject.content_rule_sudo_require_reauthentication fails due to space in in the "timestamp_timeout" value
• BZ - 2152658 - Update RHEL8 DISA STIG profile to V1R9
• BZ - 2153547 - SCAP rule accounts_password_pam_unix_remember fails to remediate on RHEL 8.8
• BZ - 2156192 - Some rules have proper STIG references but they are not part of STIG profile
• BZ - 2158404 - Rebase SSG to the latest upstream version in RHEL 8.8
• BZ - 2162803 - Two CIS Level 2 Benchmarks are listed in scap-security-guide under CIS Level 1 Profile

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.8_release_notes/index