Issued:

2020-12-15

Updated:

2020-12-15

RHBA-2020:5451 - scap-security-guide bug fix and enhancement update

Synopsis

scap-security-guide bug fix and enhancement update

Type/Severity

Bug Fix Advisory None

Topic

An update for scap-security-guide is now available for Red Hat Enterprise Linux 7.

Description

The scap-security-guide project provides a guide for configuration of the system from the final system's security point of view. The guidance is specified in the Security Content Automation Protocol (SCAP) format and constitutes a catalog of practical hardening advice, linked to government requirements where applicable. The project bridges the gap between generalized policy requirements and specific implementation guidelines.

Bug Fix(es) and Enhancement(s):

• The "DISA STIG for Red Hat Enterprise Linux 7" profile in the SCAP Security Guide has been updated to the latest version V3R1. This update adds more coverage and fixes reference problems. The profile is now also more stable and better aligns with the RHEL7 STIG benchmark provided by the Defense Information Systems Agency (DISA).

You should use only the current version of this profile because the older versions of this profile are no longer valid. The OVAL checks for several rules have changed, and scans using the V3R1 version will fail for systems that were hardened using older versions of SCAP Security Guide. You can fix the rules automatically by running the remediation with the new version of SCAP Security Guide.

WARNING: Automatic remediation might render the system non-functional. Run the remediation in a test environment first.

The following rules have been changed:

CCE-80224-9:: The default value of this SSHD configuration has changed from "delayed" to "yes". You must now provide a value according to recommendations. Check the rule description for information about fixing this problem or run the remediation to fix it automatically.

CCE-80393-2:: xccdf_org.ssgproject.content_rule_audit_rules_execution_chcon CCE-80394-0:: xccdf_org.ssgproject.content_rule_audit_rules_execution_restorecon CCE-80391-6:: xccdf_org.ssgproject.content_rule_audit_rules_execution_semanage CCE-80660-4:: xccdf_org.ssgproject.content_rule_audit_rules_execution_setfiles CCE-80392-4:: xccdf_org.ssgproject.content_rule_audit_rules_execution_setsebool CCE-82362-5:: xccdf_org.ssgproject.content_rule_audit_rules_execution_seunshare CCE-80398-1:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chage CCE-80404-7:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_chsh CCE-80410-4:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_crontab CCE-80397-3:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_gpasswd CCE-80403-9:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_newgrp CCE-80411-2:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_pam_timestamp_check CCE-27437-3:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands CCE-80395-7:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_passwd CCE-80406-2:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postdrop CCE-80407-0:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_postqueue CCE-80408-8:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_ssh_keysign CCE-80402-1:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudoedit CCE-80401-3:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_sudo CCE-80400-5:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_su CCE-80405-4:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_umount CCE-80396-5:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_unix_chkpwd CCE-80399-9:: xccdf_org.ssgproject.content_rule_audit_rules_privileged_commands_userhelper

(BZ#1665233)

Solution

Before applying this update, make sure all previously released errata relevant to your system have been applied.

For details on how to apply this update, refer to:

https://access.redhat.com/articles/11258

Affected Products

Updated Packages

• scap-security-guide-0.1.52-2.el7_9.noarch.rpm
• scap-security-guide-0.1.52-2.el7_9.src.rpm
• scap-security-guide-doc-0.1.52-2.el7_9.noarch.rpm

Fixes

• This content is not included.BZ - 1665233

CVEs

(none)

References

• https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/html/7.9_release_notes/index

Additional information

• The Red Hat security contact is This content is not included.secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.
• Offline Security Data data is available for integration with other systems. See Offline Security Data API to get started.