Issued:

2015-03-05

Updated:

2015-03-05

RHBA-2015:0339 - p11-kit bug fix and enhancement update

Synopsis

p11-kit bug fix and enhancement update

Type/Severity

Bug Fix Advisory (none)

Topic

Updated p11-kit packages that fix several bugs and add various enhancements are now available for Red Hat Enterprise Linux 7.

Description

The p11-kit packages provide a mechanism to manage PKCS#11 modules. The p11-kit-trust subpackage includes a PKCS#11 trust module that provides certificate anchors and black lists based on configuration files.

The p11-kit packages have been upgraded to upstream version 0.20.7, which provides a number of bug fixes and enhancements over the previous version, including thread-safe readdir() function, a fix for minor integer overflow in the p11_buffer_append() function, a fix for occasional segmentation fault in the p11_buffer_append() function, and an API that implements the external trust policy. Moreover, this update adds a 'trust' tool to configure root certificate anchors on the system. It also adds API that allows for other system components such as GnuTLS to accept the certificate trust information. (BZ#1122528, BZ#984989, BZ#985009, BZ#985019, BZ#985497, BZ#1125965, BZ#1142305)

This update also fixes the following bugs:

• With this update, the behavior of static local variables has been optimized to prevent accidental writes to these variables. (BZ#985337)

• Due to a bug in the coolkey p11-kit module, when using this module, other modules were not included in the /etc/pki/nssdb file. This bug has been fixed, and all p11-kit modules are now added to /etc/pki/nssdb as expected. (BZ#1128615)

• Previously, multi-arch installations on IBM System z failed to integrate with Network Security Services (NSS). This bug has been fixed, and multi-arch installs now integrate with NSS correctly. (BZ#1174178)

Users of p11-kit are advised to upgrade to these updated packages, which fix these bugs and add these enhancements. This update is required by gnutls 3.3.x packages.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• p11-kit-debuginfo-0.20.7-3.el7.ppc.rpm
• p11-kit-devel-0.20.7-3.el7.ppc64.rpm
• p11-kit-devel-0.20.7-3.el7.x86_64.rpm
• p11-kit-0.20.7-3.el7.src.rpm
• p11-kit-trust-0.20.7-3.el7.ppc64.rpm
• p11-kit-0.20.7-3.el7.x86_64.rpm
• p11-kit-devel-0.20.7-3.el7.s390x.rpm
• p11-kit-0.20.7-3.el7.i686.rpm
• p11-kit-0.20.7-3.el7.ppc.rpm
• p11-kit-debuginfo-0.20.7-3.el7.s390x.rpm
• p11-kit-trust-0.20.7-3.el7.s390x.rpm
• p11-kit-0.20.7-3.el7.s390.rpm
• p11-kit-debuginfo-0.20.7-3.el7.x86_64.rpm
• p11-kit-devel-0.20.7-3.el7.ppc.rpm
• p11-kit-debuginfo-0.20.7-3.el7.s390.rpm
• p11-kit-devel-0.20.7-3.el7.s390.rpm
• p11-kit-0.20.7-3.el7.ppc64.rpm
• p11-kit-debuginfo-0.20.7-3.el7.ppc64.rpm
• p11-kit-debuginfo-0.20.7-3.el7.i686.rpm
• p11-kit-trust-0.20.7-3.el7.x86_64.rpm
• p11-kit-doc-0.20.7-3.el7.noarch.rpm
• p11-kit-0.20.7-3.el7.s390x.rpm
• p11-kit-devel-0.20.7-3.el7.i686.rpm

Fixes

• This content is not included.BZ - 985009
• This content is not included.BZ - 985337
• This content is not included.BZ - 985497
• This content is not included.BZ - 1122528
• This content is not included.BZ - 1125965
• This content is not included.BZ - 1128615
• This content is not included.BZ - 1142305
• This content is not included.BZ - 1148774
• This content is not included.BZ - 1174178

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.