Bug 1182337

Summary: nss-softokn updates should require the same nss-softokn-freebl
Product: Red Hat Enterprise Linux 6 Reporter: Johnny Hughes <johnny>
Component: nss-softoknAssignee: Elio Maldonado Batiz <emaldona>
Status: CLOSED DUPLICATE QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 6.6CC: ajb, ashbyj, emaldona, ewwhite, fahmed, ifloodmu, jsiddle, kbsingh, kkartikeya, masterrex, mkolaja, rhbugs, riehecky, timc, tis, toracat
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-02-11 18:27:18 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Johnny Hughes 2015-01-14 21:48:18 UTC
Description of problem:
Based on issues with several CentOS user updates:

nss-softokn updates should require nss-softokn-freebl of the same version to be updated as well.

People were able to update nss-softokn (yum update nss-softokn) without upgrading nss-softokn-freebl .. The update completes fine, but with an older nss-softokn-freebl.

These mismatched versions caused major issues and renders yum and rpm unusable.

You can either upgrade to a newer version of nss-softokn and do not upgrade nss-softokn-freebl .. or downgrade nss-softokn-freebl and see the results.

yum and rpm will happily install an older nss-softokn-freebl.

Comment 2 David van de Meer 2015-01-15 06:57:33 UTC
Any update on this? How do you restore yum and rpm? I have mismatched version and have no way of getting the versions matched as yum and rpm are both broken

Comment 3 Anssi Johansson 2015-01-15 08:08:07 UTC
David, Bugzilla is not a support venue. If you are a Red Hat customer, consider opening a support case with them. If you are using CentOS, see https://www.centos.org/forums/viewtopic.php?p=214791&f=13#p214791 for one possible workaround. Let's continue this discussion on the forum if the workaround does not work for you.

Comment 5 john.baldwin 2015-01-16 15:05:53 UTC
David I did the steps prescribed in the Anssi Johnson post and corrected my issue on my Red hat 6.6 64bit server.  
1) wget the nss-softokn-freebl-3.14.3-19.el6_6.x86_64.rpm from a Centos 6.6 update mirror
2)rpm2cpio nss-softokn-freebl-3.14.3-19.el6_6.x86_64.rpm | cpio -idmv  (to install cause yum and rpm not functioning because of this bug)
3) cp ./lib64/libfreeblpriv3.* /lib64

Before that I was getting "error: rpmdbNextIterator: skipping h#     255 Header V3 RSA/SHA256 Signature, key ID fd431d51: BAD" when doing a rpm -qa command.  No rpm rebuild worked.  Those 3 steps fixed it.

Comment 6 john.baldwin 2015-01-16 16:12:31 UTC
(In reply to john.baldwin from comment #5)
> David I did the steps prescribed in the Anssi Johnson post and corrected my
> issue on my Red hat 6.6 64bit server.  
> 1) wget the nss-softokn-freebl-3.14.3-19.el6_6.x86_64.rpm from a Centos 6.6
> update mirror
> 2)rpm2cpio nss-softokn-freebl-3.14.3-19.el6_6.x86_64.rpm | cpio -idmv  (to
> install cause yum and rpm not functioning because of this bug)
> 3) cp ./lib64/libfreeblpriv3.* /lib64
> 
> Before that I was getting "error: rpmdbNextIterator: skipping h#     255
> Header V3 RSA/SHA256 Signature, key ID fd431d51: BAD" when doing a rpm -qa
> command.  No rpm rebuild worked.  Those 3 steps fixed it.

Understand cd /  before doing step 2

Comment 7 Elio Maldonado Batiz 2015-01-19 22:30:31 UTC
I believe this bug is a duplicate of Bug 1183448 and that one was cloned from Bug 1182662 which has the analysis.

Comment 8 manuel wolfshant 2015-01-20 14:19:45 UTC
both bugs mentioned in comment #7 are restricted

Comment 9 W. Rex Hardin 2015-01-26 19:30:01 UTC
Is there an ETA for the fix? Definitely hit this trying to yum install 389-ds on CentOS 6.5.

Comment 10 Elio Maldonado Batiz 2015-01-26 21:34:17 UTC
Two weeks or sooner is my guess.

Comment 11 Marcel Kolaja 2015-01-30 10:50:00 UTC
This bug should be resolved in RHEL 6.6.z within bug #1183448 and will be resolved in RHEL 6.7 within bug #1182662. Am I getting it right Elio? Thanks!

Comment 12 Elio Maldonado Batiz 2015-02-01 19:03:10 UTC
Marcel, you got it right. It has been solved on RHEL-6.6.z as an advisory for nss-softokn with two bugs fixes, one of which is for bug #1183448, went live last week. CentOS 6.6 has picked up the fix already.

Comment 13 Marcel Kolaja 2015-02-11 17:37:07 UTC
(In reply to Elio Maldonado Batiz from comment #12)
> Marcel, you got it right. It has been solved on RHEL-6.6.z as an advisory
> for nss-softokn with two bugs fixes, one of which is for bug #1183448, went
> live last week. CentOS 6.6 has picked up the fix already.

Should this one be closed then?

Comment 14 Elio Maldonado Batiz 2015-02-11 18:27:18 UTC

*** This bug has been marked as a duplicate of bug 1183448 ***