Red Hat Bugzilla – Bug 1444860
PKCS #11 slot leakage hampers unload of nss-pem
Last modified: 2018-04-10 07:46:18 EDT
Description of problem: The PKCS #11 slot object returned by SECMOD_WaitForAnyTokenEvent() is leaked, which later prevents nss-pem from being unloaded. Version-Release number of selected component (if applicable): curl-7.29.0-42.el7 Steps to Reproduce: 1. install nss-pem-1.0.3-2.el7 2. load a private key from file using libcurl Actual results: nss-pem fails to unload Expected results: nss-pem unloads properly Additional info: This bug was revealed by the following nss-pem commit: https://github.com/kdudka/nss-pem/commit/eefef228 Unfortunately, reverting the commit would reintroduce the one second sleep after loading a private key, which is something we do not want to do?
upstream commit: https://github.com/curl/curl/commit/curl-7_54_0-24-gc8ea86f
Removing the Regression keyword. The bug is triggered by a change in nss-pem, so the change will be reverted.
This can be tested by the test for bug #1445384 with patched nss-pem (after reverting the revert).
Created attachment 1393709 [details] [WIP] test-case patch Please clone /CoreOS/curl/Regression/bz694294-curl-AND-nss-need-to-be-able-to-use-pem-files and apply the attached patch on top if it. It fails with: libcurl-7.29.0-42.el7 nss-pem-1.0.3-2.el7 ... but passes with: libcurl-7.29.0-46 nss-pem-1.0.3-2.el7
Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:0732