RHEA-2020:0791 - Product Enhancement Advisory

Topic

Updated RHUI 3 packages that add two enhancements are now available.

Description

Red Hat Update Infrastructure (RHUI) is a highly scalable, highly redundant framework that enables you to manage repositories and content. It also enables cloud providers to deliver content and updates to Red Hat Enterprise Linux (RHEL) instances. Based on the upstream Pulp project, RHUI allows cloud providers to mirror Red Hat-hosted repository content locally, create custom repositories with their own content, and make those repositories available to a large group of end users through a load-balanced content delivery system.

This update adds the following enhancements:

• To tighten security, all SSL protocols as well as TLS protocols older than version 1.2 are now disabled. Clients running RHEL 6 and newer will use TLS 1.2 automatically. Note that for this change to take effect, you must reapply the configuration to existing CDS instances as described at https://access.redhat.com/solutions/4883961. (BZ#1637261)

Important: Because RHEL 5 does not support TLS 1.2, clients running RHEL 5 will not be able to use Yum repositories from RHUI 3.1.5 after this change. If you have RHEL 5 clients, do not reapply the configuration, or remove "-TLSv1 -TLSv1.1" from the /etc/httpd/conf.d/ssl.conf file and restart the httpd service on your CDS instances to revert this change. However, then you will not be able to enforce TLS 1.2.

• Previously, when RHUI administrators were asked to log in to rhui-manager, unnecessary and potentially confusing messages were displayed. Now, rhui-manager only informs the administrators about the fact that a login is required, and if the password has not been changed yet, a change is recommended. (BZ#1805385)

Red Hat advises users of RHUI to upgrade to the updated packages that add these enhancements.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

• Red Hat Update Infrastructure 3 for RHEL 7 x86_64

Fixes

• BZ - 1637261 - RFE disable weak encryption in RHUA 3
• BZ - 1805385 - Auth certificate does not regenerate properly if it is expired

CVEs

(none)

References

(none)