Bug 1371901

Summary:	Use OAEP padding with custodia
Product:	Red Hat Enterprise Linux 7	Reporter:	Christian Heimes <cheimes>
Component:	ipa	Assignee:	IPA Maintainers <ipa-maint>
Status:	CLOSED ERRATA	QA Contact:	Kaleem <ksiddiqu>
Severity:	urgent	Docs Contact:
Priority:	unspecified
Version:	7.4	CC:	cheimes, dpal, jcholast, lmiksik, mbasti, nsoman, pvoborni, rcritten
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	ipa-4.4.0-10.el7	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1371902 (view as bug list)		Environment:
Last Closed:	2016-11-04 06:02:27 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:
Bug Blocks:	1371902

Description Christian Heimes 2016-08-31 12:02:14 UTC

Description of problem:

A security in python-jwcrypto was found. The jwcrypto implementation of the RSA1_5 algorithm is vulnerable to the Million Message Attack described in RFC 3128. RSA with PKCS1v1.5 is used by Custodia and ipapython.secrets


Version-Release number of selected component (if applicable):
<= 0.3


Additional info:
Upstream bug report: https://github.com/latchset/jwcrypto/pull/66
Upstream fix: https://github.com/latchset/jwcrypto/pull/66

Comment 2 Martin Bašti 2016-08-31 12:19:46 UTC

Upstream ticket:
https://fedorahosted.org/freeipa/ticket/6278

Comment 3 Martin Bašti 2016-09-05 16:14:50 UTC

Fixed upstream
master:
https://fedorahosted.org/freeipa/changeset/4ae4d0d6909e99892442a170288f0eee9610d1c2
ipa-4-4:
https://fedorahosted.org/freeipa/changeset/71e7cb124d021f976eebb6e99fc012becf94a9b6
ipa-4-3:
https://fedorahosted.org/freeipa/changeset/2e27b7077d280447dbf526b567566101d4c800c7

Comment 4 Dmitri Pal 2016-09-06 20:33:10 UTC

We need this fixed ASAP because it opens a door for an attack. The change is simple and minor. Patch is provided.

Comment 5 Martin Bašti 2016-09-07 10:21:27 UTC

Changing BZ description to match what was fixed in code. We started using safer padding method.

Comment 8 Kaleem 2016-09-22 15:16:01 UTC

Verified SanityOnly.

Comment 11 errata-xmlrpc 2016-11-04 06:02:27 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2016-2404.html