Bug 1686135

Summary: logging-es using cryptographically weak hashing algorithm.
Product: OpenShift Container Platform Reporter: Jeff Cantrill <jcantril>
Component: LoggingAssignee: Jeff Cantrill <jcantril>
Status: CLOSED ERRATA QA Contact: Anping Li <anli>
Severity: high Docs Contact:
Priority: unspecified    
Version: 3.10.0CC: anli, aos-bugs, rmeggins, sfu
Target Milestone: ---   
Target Release: 3.10.z   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Cause: The remote service is using a SSL/TLS certificate in the certificate chain that has been signed using a cryptographically weak hashing algorithm Consequence: Increased vulnerability Fix: Update to a stronger hashing algorithm Result: Improved security
 Story Points: ---
Clone Of: 1685618 Environment:
Last Closed: 2019-04-09 23:40:43 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 1684332, 1685618    
Bug Blocks:    

Description Jeff Cantrill 2019-03-06 19:50:16 UTC 
+++ This bug was initially created as a clone of Bug #1685618 +++

+++ This bug was initially created as a clone of Bug #1684332 +++

Description of problem:
SSL/TLS: Certificate Signed Using A Weak Signature Algorithm


How reproducible:
Customer using Vulnerability scanning tool to get this issue report


Below is the details:
==============================================
Summary
The remote service is using a SSL/TLS certificate in the certificate chain that has been signed
using a cryptographically weak hashing algorithm.


Vulnerability Detection Result
The following certificates are part of the certificate chain but using insecure
,→signature algorithms:
Subject:
CN=logging-es,OU=OpenShift,O=Logging
Signature Algorithm: sha1WithRSAEncryption


Solution
Solution type: Mitigation
Servers that use SSL/TLS certificates signed with a weak SHA-1, MD5, MD4 or MD2 hashing
algorithm will need to obtain new SHA-2 signed SSL/TLS certificates to avoid web browser
SSL/TLS certificate warnings.


Vulnerability Insight
The following hashing algorithms used for signing SSL/TLS certificates are considered crypto-
graphically weak and not secure enough for ongoing use:
- Secure Hash Algorithm 1 (SHA-1)
- Message Digest 5 (MD5)
- Message Digest 4 (MD4)
- Message Digest 2 (MD2)
Beginning as late as January 2017 and as early as June 2016, browser developers such as Microsoft
and Google will begin warning users when visiting web sites that use SHA-1 signed Secure Socket
Layer (SSL) certificates.
NOTE: The script preference allows to set one or more custom SHA-1 fingerprints of CA certifi-
cates which are trusted by this routine. The fingerprints needs to be passed comma-separated
and case-insensitive:
Fingerprint1
or
fingerprint1,Fingerprint2


Vulnerability Detection Method
Check which hashing algorithm was used to sign the remote SSL/TLS certificate.
Details:SSL/TLS: Certificate Signed Using A Weak Signature Algorithm
OID:1.3.6.1.4.1.25623.1.0.105880
Version used: $Revision: 8810 $
==============================================
Comment 2 Anping Li 2019-03-25 06:00:11 UTC 
fix in openshift-ansible v3.10.127
Comment 4 errata-xmlrpc 2019-04-09 23:40:43 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2019:0620