Issued:

2012-06-20

Updated:

2012-06-20

RHBA-2012:0920 - jss bug fix update

Synopsis

jss bug fix update

Type/Severity

Bug Fix Advisory (none)

Topic

Updated jss packages that fix several bugs are now available for Red Hat Enterprise Linux 6.

Description

JSS (Java Security Services) is a Java binding to Network Security Services (NSS), which provides SSL/TLS network protocols and other security services in the Public Key Infrastructure (PKI) suite. JSS is primarily utilized by the Certificate Server.

This update fixes the following bugs:

• During key archival process, DRM (Data Recovery Manager) decrypted user's private keys and then re-encrypted the keys for storage purposes. The reverse process took place during key recovery; therefore, the private key was not processed in a token at all times as the decrypted private key was present in the DRM memory between the time of decryption and encryption. This update adds the secure PKCS #12 and PKCS #5 v2.0 support, support for wrapping and unwrapping private keys in their token, and secure private key handling for TMS (Token Management System) key recovery to Red Hat Certificate System 8.1. As a result, the key archival operations now happen in the token. (BZ#767768)

• The "kra.storageUnit.hardware" configuration parameter did not exist in DRM's CS.cfg after upgrade. Consequently, if parameter "kra.storageUnit.hardware" was defined, recovery operations failed and the server returned the following error message:

  PKCS #12 Creation Failed java.lang.IllegalArgumentException: bagType or bagContent is null

This update modifies the jss, pki-kra, pki-common components so that the "kra.storageUnit.hardware" configuration parameter is processed correctly. As a result, the key archival and recovery process is successful on in-place upgraded and migrated instances. (BZ#767771)

• Previously, JSS was using the HSM (Hardware Security Module) token name as manufacturer ID. If the HSM token name differed from the manufacturer ID, the key archival and recovery failed. This update adds logic to JSS so that it can recognize the currently supported HSMs: nCipher and SafeNet. Key archival and recovery in TMS and non-TMS Common Criteria environments now work as expected. (BZ#767773)

All users of jss are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously-released errata relevant to your system have been applied.

This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/knowledge/articles/11258

Affected Products

Updated Packages

• jss-4.2.6-22.el6.src.rpm
• jss-4.2.6-22.el6.i686.rpm
• jss-debuginfo-4.2.6-22.el6.ppc64.rpm
• jss-javadoc-4.2.6-22.el6.i686.rpm
• jss-javadoc-4.2.6-22.el6.ppc64.rpm
• jss-debuginfo-4.2.6-22.el6.s390x.rpm
• jss-debuginfo-4.2.6-22.el6.i686.rpm
• jss-4.2.6-22.el6.s390x.rpm
• jss-4.2.6-22.el6.x86_64.rpm
• jss-4.2.6-22.el6.ppc64.rpm
• jss-javadoc-4.2.6-22.el6.s390x.rpm
• jss-javadoc-4.2.6-22.el6.x86_64.rpm
• jss-debuginfo-4.2.6-22.el6.x86_64.rpm

Fixes

(none)

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.