Security Fix(es) :

  - pki-core: Mishandled ACL configuration in AAclAuthz.java     reverses rules that allow and deny access     (CVE-2018-1080)

Bug Fix(es) :

  - Previously, when ECC keys were enrolled, Certificate     Management over CMS (CMC) authentication failed with a     'TokenException: Unable to insert certificate into     temporary database' error. As a consequence, the     enrollment failed. This update fixes the problem. As a     result, the mentioned bug no longer occurs.

  - Previously, Certificate System used the same enrollment     profiles for issuing RSA and ECC certificates. As a     consequence, the key usage extension in issued     certificates did not meet the Common Criteria standard.
    This update adds ECC-specific enrollment profiles where     the key usage extension for TLS server and client     certificates are different as described in RFC 6960.
    Additionally, the update changes existing profiles to     issue only RSA certificates. As a result, the key usage     extension in ECC certificates now meets the Common     Criteria standard.

  - The Certificate System server rejects saving invalid     access control lists (ACL). As a consequence, when     saving an ACL with an empty expression, the server     rejected the update and the pkiconsole utility displayed     an StringIndexOutOfBoundsException error. With this     update, the utility rejects empty ACL expressions. As a     result, invalid ACLs cannot be saved and the error is no     longer displayed.

  - Previously, due to a bug in the Certificate System     installation procedure, installing a Key Recovery     Authority (KRA) with ECC keys failed. To fix the     problem, the installation process has been updated to     handle both RSA and ECC subsystems automatically. As a     result, installing subsystems with ECC keys no longer     fail.

  - Previously, during verification, Certificate System     encoded the ECC public key incorrectly in CMC     Certificate Request Message Format (CRMF) requests. As a     consequence, requesting an ECC certificate with     Certificate Management over CMS (CMC) in CRMF failed.
    The problem has been fixed, and as a result, CMC CRMF     requests using ECC keys work as expected.

Enhancement(s) :

  - The pkispawn man page has been updated and now describes     the - --skip- configuration and --skip-installation     parameters.

  - With this update, Certificate System adds the Subject     Alternative Name (SAN) extension by default to server     certificates and sets it to the Common Name (CN) of the     certificate.

  - With this enhancement, users can create Certificate     Request Message Format (CRMF) requests without the key     archival option when using the CRMFPopClient utility.
    This feature increases flexibility because a Key     Recovery Authority (KRA) certificate is no longer     required. Previously, if the user did not pass the '-b     transport_certificate_file' option to CRMFPopClient, the     utility automatically used the KRA transport certificate     stored in the transport.txt file. With this update, if     '-b transport_certificate_file' is not specified,     Certificate System creates a request without using key     archival.

Detections

Analytics

Scientific Linux Security Update : pki-core on SL7.x x86_64 (20180626)

high Nessus Plugin ID 110719

Version 1.6