RHBA-2023:7056 - Bug Fix Advisory

Topic

An update for scap-security-guide is now available for Red Hat Enterprise Linux
8.

Description

For detailed information on changes in this release, see the Red Hat Enterprise
Linux %s Release Notes linked from the References section.

Solution

For details on how to apply this update, which includes the changes described
in this advisory, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Enterprise Linux for x86_64 8 x86_64
• Red Hat Enterprise Linux for IBM z Systems 8 s390x
• Red Hat Enterprise Linux for Power, little endian 8 ppc64le
• Red Hat Enterprise Linux for ARM 64 8 aarch64

Fixes

• BZ - 2129100 - After provisioning with ospp profile remediation, enable_fips_mode fails on s390x
• BZ - 2130181 - FIPS enabled profiles built in offline mode with image-builder won't boot
• BZ - 2130182 - Login issues after anssi profile remediation with image-builder images
• BZ - 2130185 - Offline remediation of fstab permissions fails in Image Builder
• BZ - 2155789 - Update ANSSI BP-028 in RHEL8 to v2.0
• BZ - 2157877 - Definition of interactive an non interactive users
• BZ - 2167999 - content_rule_audit_rules_login_events_faillock not selected on DISA STIG Profile
• BZ - 2169857 - Applying CIS benchmark fix cause systemd-journald to unable to parse configuration file
• BZ - 2170530 - xccdf_org.ssgproject.content_rule_postfix_prevent_unrestricted_relay should allow whitespace in "smtpd_client_restrictions" value
• BZ - 2175684 - AIDE compliancy
• BZ - 2175882 - scap results should be clear about what values are acceptable for "pam faillock deny" and "pam faillock interval".
• BZ - 2176008 - "Add xxx Option to /var/log" and "Add xxx Option to /var/log/audit" should return "notapplicable" when no dedicated mount point is used
• BZ - 2178516 - Fix CCE link in compliance issue description
• BZ - 2178740 - system account with uid >= 1000 is badly detected as user interactive account
• BZ - 2184487 - CIS profile flags the permissions on /boot/efi/EFI/redhat/user.cfg, but the permissions cannot be changed as directed
• BZ - 2192893 - ".include =" in rhel8-playbook-stig.yml causing STIG to flag it.
• BZ - 2209073 - Please explain if "accounts_passwords_pam_faillock_interval" should apply to RHEL8.2+ or not
• BZ - 2221695 - Rebase scap-security-guide in Red Hat Enterprise Linux 8.9 to latest upstream version
• BZ - 2222583 - Remote resource referenced from datastream is missing https://access.redhat.com/security/data/oval/com.redhat.rhsa-RHEL8.xml.bz2

CVEs

(none)

References

• https://access.redhat.com/documentation/en-
• us/red_hat_enterprise_linux/8/html/8.9_release_notes/index