Issued:

2018-05-14

Updated:

2018-05-14

RHBA-2018:1405 - openscap bug fix update

Synopsis

openscap bug fix update

Type/Severity

Bug Fix Advisory None

Topic

Updated openscap packages that fix two bugs are now available for Red Hat Enterprise Linux 7.

Description

The OpenSCAP suite enables integration of the Security Content Automation Protocol (SCAP) line of standards. The openscap packages provide the OpenSCAP library and the oscap utility that provides various SCAP capabilities.

This update fixes the following bugs:

• Previously, the textfilecontent54 probe did not work properly in offline mode. As a consequence, the oscap-docker tool and the atomic scan command reported different results for the same rule that checked the contents of a file. With this update, the previous removal of the chroot() function in offline mode of the textfilecontent54 probe has been reverted. As a result, oscap-docker and atomic scan no longer report different results with the same rule in the described scenario. (BZ#1566588)

• Prior to this update, the rpminfo, rpmverify, rpmverifyfile, and rpmverifypackage probes did not fully support offline mode. Consequently, OpenSCAP RPM verification rules did not work correctly when scanning virtual machine (VM) and container file systems in offline mode. With this update, the previous removal of the chroot() function in the offline scan in rpm probes has been reverted and offline mode in those probes has been fixed. Results of scanning VM and container file systems in offline mode no longer contain false negatives. (BZ#1569150)

Users of openscap are advised to upgrade to these updated packages, which fix these bugs.

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• openscap-engine-sce-1.2.16-8.el7_5.s390x.rpm
• openscap-utils-1.2.16-8.el7_5.x86_64.rpm
• openscap-devel-1.2.16-8.el7_5.i686.rpm
• openscap-extra-probes-1.2.16-8.el7_5.aarch64.rpm
• openscap-scanner-1.2.16-8.el7_5.x86_64.rpm
• openscap-engine-sce-1.2.16-8.el7_5.x86_64.rpm
• openscap-1.2.16-8.el7_5.src.rpm
• openscap-1.2.16-8.el7_5.ppc64le.rpm
• openscap-python-1.2.16-8.el7_5.ppc64.rpm
• openscap-engine-sce-1.2.16-8.el7_5.ppc.rpm
• openscap-engine-sce-1.2.16-8.el7_5.s390.rpm
• openscap-python-1.2.16-8.el7_5.aarch64.rpm
• openscap-python-1.2.16-8.el7_5.x86_64.rpm
• openscap-engine-sce-1.2.16-8.el7_5.ppc64le.rpm
• openscap-scanner-1.2.16-8.el7_5.s390x.rpm
• openscap-debuginfo-1.2.16-8.el7_5.aarch64.rpm
• openscap-debuginfo-1.2.16-8.el7_5.ppc64.rpm
• openscap-scanner-1.2.16-8.el7_5.aarch64.rpm
• openscap-utils-1.2.16-8.el7_5.aarch64.rpm
• openscap-debuginfo-1.2.16-8.el7_5.i686.rpm
• openscap-engine-sce-1.2.16-8.el7_5.i686.rpm
• openscap-scanner-1.2.16-8.el7_5.ppc64le.rpm
• openscap-extra-probes-1.2.16-8.el7_5.ppc64.rpm
• openscap-utils-1.2.16-8.el7_5.ppc64.rpm
• openscap-1.2.16-8.el7_5.ppc64.rpm
• openscap-1.2.16-8.el7_5.i686.rpm
• openscap-engine-sce-devel-1.2.16-8.el7_5.s390.rpm
• openscap-extra-probes-1.2.16-8.el7_5.ppc64le.rpm
• openscap-debuginfo-1.2.16-8.el7_5.s390x.rpm
• openscap-engine-sce-devel-1.2.16-8.el7_5.x86_64.rpm
• openscap-devel-1.2.16-8.el7_5.s390x.rpm
• openscap-1.2.16-8.el7_5.aarch64.rpm
• openscap-devel-1.2.16-8.el7_5.ppc64.rpm
• openscap-devel-1.2.16-8.el7_5.x86_64.rpm
• openscap-extra-probes-1.2.16-8.el7_5.x86_64.rpm
• openscap-1.2.16-8.el7_5.s390.rpm
• openscap-engine-sce-devel-1.2.16-8.el7_5.i686.rpm
• openscap-debuginfo-1.2.16-8.el7_5.x86_64.rpm
• openscap-engine-sce-devel-1.2.16-8.el7_5.aarch64.rpm
• openscap-1.2.16-8.el7_5.x86_64.rpm
• openscap-devel-1.2.16-8.el7_5.ppc64le.rpm
• openscap-python-1.2.16-8.el7_5.ppc64le.rpm
• openscap-debuginfo-1.2.16-8.el7_5.ppc.rpm
• openscap-1.2.16-8.el7_5.ppc.rpm
• openscap-utils-1.2.16-8.el7_5.ppc64le.rpm
• openscap-devel-1.2.16-8.el7_5.s390.rpm
• openscap-python-1.2.16-8.el7_5.s390x.rpm
• openscap-engine-sce-devel-1.2.16-8.el7_5.ppc64le.rpm
• openscap-engine-sce-devel-1.2.16-8.el7_5.s390x.rpm
• openscap-devel-1.2.16-8.el7_5.ppc.rpm
• openscap-engine-sce-devel-1.2.16-8.el7_5.ppc64.rpm
• openscap-scanner-1.2.16-8.el7_5.ppc64.rpm
• openscap-containers-1.2.16-8.el7_5.noarch.rpm
• openscap-engine-sce-1.2.16-8.el7_5.ppc64.rpm
• openscap-devel-1.2.16-8.el7_5.aarch64.rpm
• openscap-engine-sce-1.2.16-8.el7_5.aarch64.rpm
• openscap-debuginfo-1.2.16-8.el7_5.s390.rpm
• openscap-debuginfo-1.2.16-8.el7_5.ppc64le.rpm
• openscap-engine-sce-devel-1.2.16-8.el7_5.ppc.rpm
• openscap-1.2.16-8.el7_5.s390x.rpm
• openscap-utils-1.2.16-8.el7_5.s390x.rpm
• openscap-extra-probes-1.2.16-8.el7_5.s390x.rpm

Fixes

• This content is not included.BZ - 1566588
• This content is not included.BZ - 1569150

CVEs

(none)

References

(none)

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.