Bug 1395095 - RHSA-2016:2674: libgcrypt security update
Summary: RHSA-2016:2674: libgcrypt security update
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: sadc-container
Version: 7.4
Hardware: x86_64
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Frantisek Kluknavsky
QA Contact: atomic-bugs@redhat.com
Vikram Goyal
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-11-15 06:35 UTC by Alex Jia
Modified: 2017-01-17 23:33 UTC (History)
2 users (show)

Fixed In Version: 7.3-16
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-01-17 23:33:54 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2017:0144 0 normal SHIPPED_LIVE Red Hat Enterprise Linux Atomic sadc Container Image Update 2017-01-18 04:43:44 UTC

Description Alex Jia 2016-11-15 06:35:02 UTC 
Description of problem:
atomic scan complains CVE error "RHSA-2016:2674: libgcrypt security update (Moderate)" in rhel7/sadc:latest (665ff3a7520a)

Version-Release number of selected component (if applicable):

[root@atomic-host-001 cloud-user]# cat /etc/redhat-release 
Red Hat Enterprise Linux Atomic Host release 7.3

[root@atomic-host-001 cloud-user]# atomic host status
State: idle
Deployments:
● rhel-atomic-host:rhel-atomic-host/7/x86_64/standard
       Version: 7.3.1 (2016-11-11 03:25:08)
        Commit: 6f182afa309da8df96470ba050845629f698946e9222f67eece5a1197e296c87
        OSName: rhel-atomic-host
  GPGSignature: (unsigned)
      Unlocked: development

[root@atomic-host-001 cloud-user]# getenforce
Permissive

[root@atomic-host-001 cloud-user]# rpm -q atomic skopeo docker
atomic-1.13.8-1.el7.x86_64
skopeo-0.1.17-0.5.git1f655f3.el7.x86_64
docker-1.12.3-2.el7.x86_64

[root@atomic-host-001 cloud-user]# atomic images list
   REPOSITORY                                  TAG      IMAGE ID       CREATED            VIRTUAL SIZE   TYPE       
☠  rhel7/sadc                                  latest   665ff3a7520a   2016-10-31 12:01   204.59 MB      Docker    
☠  registry.access.redhat.com/rhel7/openscap   latest   26d9de88b340   2016-10-27 09:14   360.1 MB       Docker 
   

How reproducible:
always

Steps to Reproduce:
1. atomic pull rhel7/sadc
2. atomic scan --scanner openscap --scan_type cve --images


Actual results:

665ff3a7520ad3a2b660cc2c913d25eedd849cb5aadc91817b38bdc442b0a1dd (rhel7/sadc:latest)

The following issues were found:

     RHSA-2016:2674: libgcrypt security update (Moderate)
     Severity: Moderate
       RHSA URL: https://rhn.redhat.com/errata/RHSA-2016-2674.html
       RHSA ID: RHSA-2016:2674-01
       Associated CVEs:
           CVE ID: CVE-2016-6313
           CVE URL: https://access.redhat.com/security/cve/CVE-2016-6313


Expected results:
fix cve

Additional info:
Comment 3 Edward Shen 2017-01-16 11:43:18 UTC 
It's fixed, verified on version 7.3-17
Comment 5 errata-xmlrpc 2017-01-17 23:33:54 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:0144
Note You need to log in before you can comment on or make changes to this bug.