Bug 1395094 - RHSA-2016:2674: libgcrypt security update
Summary: RHSA-2016:2674: libgcrypt security update
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: rsyslog-container
Version: 7.4
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Frantisek Kluknavsky
QA Contact: atomic-bugs@redhat.com
Vikram Goyal
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-11-15 06:33 UTC by Alex Jia
Modified: 2017-01-17 23:23 UTC (History)
3 users (show)

Fixed In Version: 7.3-12
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-01-17 23:23:53 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0143 0 normal SHIPPED_LIVE Red Hat Enterprise Linux Atomic rsyslog Container Image Update 2017-01-18 04:26:14 UTC

Description Alex Jia 2016-11-15 06:33:30 UTC 
Description of problem:
atomic scan complains CVE error "RHSA-2016:2674: libgcrypt security update (Moderate)" in rhel7/rsyslog:latest (04f7e9543b93)

Version-Release number of selected component (if applicable):

[root@atomic-host-001 cloud-user]# cat /etc/redhat-release 
Red Hat Enterprise Linux Atomic Host release 7.3

[root@atomic-host-001 cloud-user]# atomic host status
State: idle
Deployments:
● rhel-atomic-host:rhel-atomic-host/7/x86_64/standard
       Version: 7.3.1 (2016-11-11 03:25:08)
        Commit: 6f182afa309da8df96470ba050845629f698946e9222f67eece5a1197e296c87
        OSName: rhel-atomic-host
  GPGSignature: (unsigned)
      Unlocked: development

[root@atomic-host-001 cloud-user]# getenforce
Permissive

[root@atomic-host-001 cloud-user]# rpm -q atomic skopeo docker
atomic-1.13.8-1.el7.x86_64
skopeo-0.1.17-0.5.git1f655f3.el7.x86_64
docker-1.12.3-2.el7.x86_64

[root@atomic-host-001 cloud-user]# atomic images list
   REPOSITORY                                  TAG      IMAGE ID       CREATED            VIRTUAL SIZE   TYPE       
☠  registry.access.redhat.com/rhel7/openscap   latest   26d9de88b340   2016-10-27 09:14   360.1 MB       Docker    
☠  rhel7/rsyslog                               latest   04f7e9543b93   2016-10-31 10:40   205.24 MB      Docker  

How reproducible:
always

Steps to Reproduce:
1. atomic pull rhel7/rsyslog
2. atomic scan --scanner openscap --scan_type cve --images


Actual results:

04f7e9543b939537000296e38c11d5d422653f74a6dd2a3905b931bb8f4c3265 (rhel7/rsyslog:latest)

The following issues were found:

     RHSA-2016:2674: libgcrypt security update (Moderate)
     Severity: Moderate
       RHSA URL: https://rhn.redhat.com/errata/RHSA-2016-2674.html
       RHSA ID: RHSA-2016:2674-01
       Associated CVEs:
           CVE ID: CVE-2016-6313
           CVE URL: https://access.redhat.com/security/cve/CVE-2016-6313


Expected results:
fix cve

Additional info:
Comment 3 Edward Shen 2017-01-16 07:15:03 UTC 
It's fixed, verified on 7.3-13
Comment 5 errata-xmlrpc 2017-01-17 23:23:53 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0143
Note You need to log in before you can comment on or make changes to this bug.