-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Moderate: pki-core:10.6 security and bug fix update Advisory ID: RHSA-2022:1851-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2022:1851 Issue date: 2022-05-10 CVE Names: CVE-2021-4213 ===================================================================== 1. Summary: An update for the pki-core:10.6 module is now available for Red Hat Enterprise Linux 8. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Enterprise Linux AppStream (v. 8) - aarch64, noarch, ppc64le, s390x, x86_64 3. Description: The Public Key Infrastructure (PKI) Core contains fundamental packages required by Red Hat Certificate System. Security Fix(es): * JSS: memory leak in TLS connection leads to OOM (CVE-2021-4213) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section. Additional Changes: For detailed information on changes in this release, see the Red Hat Enterprise Linux 8.6 Release Notes linked from the References section. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1904112 - pki fails to start if empty dir /var/lib/pki/pki-tomcat/kra exists 1980378 - 'keyctl_search: Required key not available' message when running 'ipa-healthcheck' 2004084 - Reinstall of the same ipa-replica fails with 'RuntimeError: CA configuration failed.' 2006070 - Upgrades incorrectly add secret attribute to connectors 2019200 - IDM fails to setup CA server in EL8.4 w/ FIPS (Backport BZ#2001576 to RHEL 8.4) 2027470 - pki-healthcheck ClonesConnectivyAndDataCheck fails 2042900 - CVE-2021-4213 JSS: memory leak in TLS connection leads to OOM 6. Package List: Red Hat Enterprise Linux AppStream (v. 8): Source: jss-4.9.3-1.module+el8.6.0+14244+60d461b7.src.rpm ldapjdk-4.23.0-1.module+el8.5.0+11983+6ba118b4.src.rpm pki-core-10.12.0-2.module+el8.6.0+14115+8b467244.src.rpm tomcatjss-7.7.1-1.module+el8.6.0+13291+248751b1.src.rpm aarch64: jss-4.9.3-1.module+el8.6.0+14244+60d461b7.aarch64.rpm jss-debuginfo-4.9.3-1.module+el8.6.0+14244+60d461b7.aarch64.rpm jss-debugsource-4.9.3-1.module+el8.6.0+14244+60d461b7.aarch64.rpm jss-javadoc-4.9.3-1.module+el8.6.0+14244+60d461b7.aarch64.rpm pki-core-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.aarch64.rpm pki-core-debugsource-10.12.0-2.module+el8.6.0+14115+8b467244.aarch64.rpm pki-symkey-10.12.0-2.module+el8.6.0+14115+8b467244.aarch64.rpm pki-symkey-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.aarch64.rpm pki-tools-10.12.0-2.module+el8.6.0+14115+8b467244.aarch64.rpm pki-tools-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.aarch64.rpm noarch: ldapjdk-4.23.0-1.module+el8.5.0+11983+6ba118b4.noarch.rpm ldapjdk-javadoc-4.23.0-1.module+el8.5.0+11983+6ba118b4.noarch.rpm pki-acme-10.12.0-2.module+el8.6.0+14115+8b467244.noarch.rpm pki-base-10.12.0-2.module+el8.6.0+14115+8b467244.noarch.rpm pki-base-java-10.12.0-2.module+el8.6.0+14115+8b467244.noarch.rpm pki-ca-10.12.0-2.module+el8.6.0+14115+8b467244.noarch.rpm pki-kra-10.12.0-2.module+el8.6.0+14115+8b467244.noarch.rpm pki-server-10.12.0-2.module+el8.6.0+14115+8b467244.noarch.rpm python3-pki-10.12.0-2.module+el8.6.0+14115+8b467244.noarch.rpm tomcatjss-7.7.1-1.module+el8.6.0+13291+248751b1.noarch.rpm ppc64le: jss-4.9.3-1.module+el8.6.0+14244+60d461b7.ppc64le.rpm jss-debuginfo-4.9.3-1.module+el8.6.0+14244+60d461b7.ppc64le.rpm jss-debugsource-4.9.3-1.module+el8.6.0+14244+60d461b7.ppc64le.rpm jss-javadoc-4.9.3-1.module+el8.6.0+14244+60d461b7.ppc64le.rpm pki-core-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.ppc64le.rpm pki-core-debugsource-10.12.0-2.module+el8.6.0+14115+8b467244.ppc64le.rpm pki-symkey-10.12.0-2.module+el8.6.0+14115+8b467244.ppc64le.rpm pki-symkey-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.ppc64le.rpm pki-tools-10.12.0-2.module+el8.6.0+14115+8b467244.ppc64le.rpm pki-tools-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.ppc64le.rpm s390x: jss-4.9.3-1.module+el8.6.0+14244+60d461b7.s390x.rpm jss-debuginfo-4.9.3-1.module+el8.6.0+14244+60d461b7.s390x.rpm jss-debugsource-4.9.3-1.module+el8.6.0+14244+60d461b7.s390x.rpm jss-javadoc-4.9.3-1.module+el8.6.0+14244+60d461b7.s390x.rpm pki-core-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.s390x.rpm pki-core-debugsource-10.12.0-2.module+el8.6.0+14115+8b467244.s390x.rpm pki-symkey-10.12.0-2.module+el8.6.0+14115+8b467244.s390x.rpm pki-symkey-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.s390x.rpm pki-tools-10.12.0-2.module+el8.6.0+14115+8b467244.s390x.rpm pki-tools-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.s390x.rpm x86_64: jss-4.9.3-1.module+el8.6.0+14244+60d461b7.x86_64.rpm jss-debuginfo-4.9.3-1.module+el8.6.0+14244+60d461b7.x86_64.rpm jss-debugsource-4.9.3-1.module+el8.6.0+14244+60d461b7.x86_64.rpm jss-javadoc-4.9.3-1.module+el8.6.0+14244+60d461b7.x86_64.rpm pki-core-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.x86_64.rpm pki-core-debugsource-10.12.0-2.module+el8.6.0+14115+8b467244.x86_64.rpm pki-symkey-10.12.0-2.module+el8.6.0+14115+8b467244.x86_64.rpm pki-symkey-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.x86_64.rpm pki-tools-10.12.0-2.module+el8.6.0+14115+8b467244.x86_64.rpm pki-tools-debuginfo-10.12.0-2.module+el8.6.0+14115+8b467244.x86_64.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2021-4213 https://access.redhat.com/security/updates/classification/#moderate https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/8/html/8.6_release_notes/ 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2022 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUBYnqRHdzjgjWX9erEAQhIwA//Y0yUonfU0lf8N0Vu/wzLfliAW+XVEhcF tDIX7A7rOwlL4rLYDuaweo453zRtI752qUBYctwYtJ3YGv0HdgAHFDwIS2aZJ3Hd C3A0APrpwJ08hH/nasY64ceAXz0GQ8dbLGiCZYFETM8zX/jtqhJG0L4rWjYpDZ3i 8mSn3EDuiDUfYWqFKGR18mO6Mze5YceD85iGoYWSDPP7FAYtUDZF5wHAJ+oh+Q9h IQCim+pJfvz3V4X6+yIo8tGlWv29MbOyTHMdX8MOJ40iECtpEljQQ2YUdWGIqqpk IEw8v7L8hKpYOQzO4tfc35/7SRzEwagM1hoXZY30Nvn6Z7z4zx2qwCiXCe3pdevh OdnFTsLuPndGMhCSX26w9jXfjpbfU4pqlMLWp4xpBdo7w3jIySVjUkmJTPlbScdi mB32lf+TFUqWvFkM0SkKtiQWvbGaHhkMXq5LCcMmnOjkYl2rmSNNaEx70ijR532B RdGpyrQGf+ELxO9wV157cZL0bpJYASD8coVCHgliC5lADP+9HNyLoDdMIdeOn+tH vKenC2zIhw6/Q9D1Kj3LM8rpbCljvueNU75Yg7XFqtrIE9T3pWhCmZWMJ/09uY5E Qbhli+B17TdEXXDRfAbwgHAuZ2GaLug5/pcOC2NX6hX+2emFdqBUjoVIrBwYokiK fQrxanplxUs= =88mv -----END PGP SIGNATURE----- -- RHSA-announce mailing list RHSA-announce@redhat.com https://listman.redhat.com/mailman/listinfo/rhsa-announce