Red Hat Bugzilla – Bug 1249720
nss-softokn 3.16.2.3-9 RSA_PopulatePrivateKey API call failure
Last modified: 2017-08-01 12:47:42 EDT
Description of problem: Failures in RSA_PopulatePrivateKey Version-Release number of selected component (if applicable): nss-softokn-freebl-3.16.2.3-9.el7.x86_64.rpm How reproducible: This is not easy to reproduce due to the software I am using to call RSA_PopulatePrivateKey. The result is that sometimes this function fails, other times it succeeds. What helped was a downgrade of the package using yum -y downgrade nss-softokn-freebl-3.15.4-2.el7 nss-softokn-freebl-devel-3.15.4-2.el7 nss-softokn-3.15.4-2.el7 nss-softokn-devel-3.15.4-2.el7 nss-3.15.4-6.el7 nss-tools-3.15.4-6.el7 nss-devel-3.15.4-6.el7 nss-sysinit-3.15.4-6.el7 I am running a test suite that is part of a swtpm package located here: https://github.com/stefanberger/swtpm.git It builds on top of libtpms located here: https://github.com/stefanberger/libtpms.git Steps to Reproduce: 1. libtpms: ./configure --prefix=/usr ; make ; sudo make install 2. swtpm: ./configure --prefix=/usr ; make check 3. swtpm individual test: ./tests/test_hashing Actual results: Test cases are sometimes failing, sometimes passing when using nss-softokn-freebl 3.16.2.3-9.el7 Expected results: Test case should always pass. Additional info: It looks to me we are hitting the bug described here: https://bugzilla.mozilla.org/show_bug.cgi?id=992240
I see upstream has fixed the bug, and the fix will be released with NSS 3.28 later this year. The fix was inside the softokn module, which we keep at a FIPS validated snapshot, so it's not yet possible to say when this can be fixed in RHEL 7.x
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHEA-2017:1977