Bug 1821615

Summary:	[GSS] SSH Server has sha1 weak kex enabled in glusterfs container
Product:	[Red Hat Storage] Red Hat Gluster Storage	Reporter:	MAYANK PANDEY <mpandey>
Component:	rhgs-server-container	Assignee:	Raghavendra Talur <rtalur>
Status:	CLOSED ERRATA	QA Contact:	Vivek Das <vdas>
Severity:	high	Docs Contact:	Amrita <asakthiv>
Priority:	unspecified
Version:	ocs-3.11	CC:	anazmy, aramteke, asakthiv, jmulligan, madam, puebele, rhs-bugs, rtalur, vdas
Target Milestone:	---	Keywords:	ZStream
Target Release:	OCS 3.11.z Batch Update 6
Hardware:	x86_64
OS:	Linux
Whiteboard:
Fixed In Version:	rhgs-server-container-3.11.6-1	Doc Type:	Bug Fix
Doc Text:	Previously, the ssh server in the rhgs-server container image supported sha1 kex algorithms. These are considered weak algorithms and need to be disabled. With this update, the default configuration in the sshd config does not include the sha1 based kex algorithms. For more information, refer to https://access.redhat.com/solutions/4278651.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2020-12-17 04:29:04 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description MAYANK PANDEY 2020-04-07 08:32:14 UTC

Description of problem:
Security scan shows that SSH server used for geo-replication in gluster container is using sha1 DH algorithms. These algorithms are considered weak.

Version-Release number of selected component (if applicable):
OCS 3.x

How reproducible:
Always

Steps to Reproduce:
Deploy OCS 3.x

Actual results:
SHA1 algorithms are enabled for key exchange

Expected results:
SHA1 algorithms are disabled for key exchange

Additional info:
https://access.redhat.com/solutions/1464563
https://access.redhat.com/articles/1456263
https://access.redhat.com/security/cve/cve-2015-4000

Comment 15 Vivek Das 2020-10-23 05:42:26 UTC

Thanks Tallur,

Based on Comment 14 moving the bug to verified.

Comment 19 errata-xmlrpc 2020-12-17 04:29:04 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory (OpenShift Container Storage 3.11.z Container Images Bug Fix Update), and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2020:5601