Created attachment 991449 [details]
Patch to verify RC4 strength

Need more information on how this bug can be verified on RHEL 6.7

(In reply to Roshni from comment #3)
> Need more information on how this bug can be verified on RHEL 6.7

You would have to write a custom client for JSS, as the RHCS REST interface that was used to find this issue does not exist on RHEL 6.x.  It should be sufficient to validate this as sanity only by applications that use JSS.

I downloaded and extracted the src files from jss-4.2.6-35.el6.src.rpm and verified the code for the changes for this bug. 

public static final KeyGenAlgorithm
    RC4 = new KeyGenAlgorithm(CKM_RC4_KEY_GEN, "RC4",
            new KeyStrengthValidator() {
                public boolean isValidKeyStrength(int strength) {
                    return true;
                }
            }, null, null);

The expected is:

public static final KeyGenAlgorithm
    RC4 = new KeyGenAlgorithm(CKM_RC4_KEY_GEN, "RC4",
            new KeyStrengthValidator() {
                public boolean isValidKeyStrength(int strength) {
                    return strength>=40 && strength <= (256*8);
                }
            }, null, null);

Roshni,
How did you look at the source?  JSS is built with the rpmbuild patching system where patches are patched in during the build.  For example, this particular patch is called something like:
jss-RC4-strengh-verify.patch

You will have to rpmbuild it to look.  Was that what you did?

OK, I was looking at mozilla/security/jss/org/mozilla/jss/crypto/KeyGenAlgorithm.java. I checked jss-RC4-strengh-verify.patch and I see the change there.

I was able to verify https://bugzilla.redhat.com/show_bug.cgi?id=1167470 and https://bugzilla.redhat.com/show_bug.cgi?id=1190302 which are application that use jss. So verifying this bug are sanity only.

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://rhn.redhat.com/errata/RHBA-2015-1315.html