Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionMatthew Harmsen
2017-05-03 02:16:52 UTC
While running TPS tests on JSS, the following two tests failed:
Upgrade Test:
libssl3.so(NSS_3.30.0.1)(64bit) is needed by jss-4.4.0-6.el7.x86_64
InstallTest:
libssl3.so(NSS_3.30.0.1)(64bit) is needed by jss-4.4.0-6.el7.x86_64
Examining the jss-4.4.0-6.el7 build, however showed both a build and runtime requirement on nss 3.28.3.
However, running the following commands revealed:
# cat jss-6-requires
# rpm -q jss
jss-4.4.0-6.el7.x86_64
# rpm -q --requires jss
java-headless
libc.so.6()(64bit)
libc.so.6(GLIBC_2.14)(64bit)
libc.so.6(GLIBC_2.2.5)(64bit)
libc.so.6(GLIBC_2.3.4)(64bit)
libc.so.6(GLIBC_2.4)(64bit)
libdl.so.2()(64bit)
libnspr4.so()(64bit)
libnss3.so()(64bit)
libnss3.so(NSS_3.10.2)(64bit)
libnss3.so(NSS_3.11.7)(64bit)
libnss3.so(NSS_3.12)(64bit)
libnss3.so(NSS_3.12.3)(64bit)
libnss3.so(NSS_3.2)(64bit)
libnss3.so(NSS_3.3)(64bit)
libnss3.so(NSS_3.4)(64bit)
libnss3.so(NSS_3.6)(64bit)
libnss3.so(NSS_3.9)(64bit)
libnssutil3.so()(64bit)
libnssutil3.so(NSSUTIL_3.12)(64bit)
libplc4.so()(64bit)
libplds4.so()(64bit)
libpthread.so.0()(64bit)
libsmime3.so()(64bit)
libsmime3.so(NSS_3.2)(64bit)
libsmime3.so(NSS_3.3)(64bit)
libssl3.so()(64bit)
libssl3.so(NSS_3.14)(64bit)
libssl3.so(NSS_3.2)(64bit)
libssl3.so(NSS_3.30.0.1)(64bit)
libssl3.so(NSS_3.4)(64bit)
nss >= 3.28.3
rpmlib(CompressedFileNames) <= 3.0.4-1
rpmlib(FileDigests) <= 4.6.0-1
rpmlib(PayloadFilesHavePrefix) <= 4.0-1
rtld(GNU_HASH)
rpmlib(PayloadIsXz) <= 5.2-1
where we see "libssl3.so(NSS_3.30.0.1)(64bit)", the culprit exposed by the TPS tests.
Asha informed us that the last known TPS tests to pass were run against jss-4.4.0-1.el7; with Asha's assistance, we slowly stepped backwards to determine that the last JSS to pass TPS tests was "jss-4.4.0-3.el7"; the differences between the rquirements for this build versus the latest are:
# diff jss-3-requires jss-6-requires
2c2
< jss-4.4.0-3.el7.x86_64
---
> jss-4.4.0-6.el7.x86_64
33a34
> libssl3.so(NSS_3.30.0.1)(64bit)
35c36
< nss >= 3.21.0
---
> nss >= 3.28.3
It turns out that "jss-4.4.0-4.el7" was the first to utilize the newer version of NSS; in addition to being compiled and linked against nss 3.28.3, the following bugs were changed in "jss-4.4.0-4.el7":
* Mon Mar 27 2017 Matthew Harmsen <mharmsen> - 4.4.0-4 - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4 - Updated build requirements for NSPR - Updated build and runtime requirements for NSS - ## 'jss-post-rebase.patch' resolves the following issues ported from - Mozilla Bugzilla #1337092 - CMC conformance update: Implement required ASN.1 code for RFC5272+ (cfu) - Mozilla Bugzilla #1347394 - Eclipse project files for JSS (edewata) - Mozilla Bugzilla #1347429 - Deprecated SSL 3.0 cipher names in SSLSocket class. (edewata) - Mozilla Bugzilla #1348856 - SSL alert callback (edewata) - Mozilla Bugzilla #1349278 - SSL cipher enumeration (edewata) - Mozilla Bugzilla #1349349 - Problem with Password.readPasswordFromConsole(). (edewata) - Mozilla Bugzilla #1349831 - Revise top-level README file (mharmsen) - Mozilla Bugzilla #1349836 - Changes to JSS Version Block (mharmsen) - Mozilla Bugzilla #1350130 - Missing CryptoManager.verifyCertificateNowCUNative() implementation. (emaldona)
As this problem exists in jss-4.4.0-4.el7, jss-4.4.0-5.el7, and jss-4.4.0-6.el7,, but not in jss-4.4.0-3.el7, this issue must be caused by either the compilation/link process with NSS 3.28.3, or one of the aforementioned bugs.
Since this issue was uncovered as a part of RHEL QE Testing, only this internal bug will be filed until the actual issues is discovered.
Comment 12Elio Maldonado Batiz
2017-05-08 15:27:09 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2017:2090
While running TPS tests on JSS, the following two tests failed: Upgrade Test: libssl3.so(NSS_3.30.0.1)(64bit) is needed by jss-4.4.0-6.el7.x86_64 InstallTest: libssl3.so(NSS_3.30.0.1)(64bit) is needed by jss-4.4.0-6.el7.x86_64 Examining the jss-4.4.0-6.el7 build, however showed both a build and runtime requirement on nss 3.28.3. However, running the following commands revealed: # cat jss-6-requires # rpm -q jss jss-4.4.0-6.el7.x86_64 # rpm -q --requires jss java-headless libc.so.6()(64bit) libc.so.6(GLIBC_2.14)(64bit) libc.so.6(GLIBC_2.2.5)(64bit) libc.so.6(GLIBC_2.3.4)(64bit) libc.so.6(GLIBC_2.4)(64bit) libdl.so.2()(64bit) libnspr4.so()(64bit) libnss3.so()(64bit) libnss3.so(NSS_3.10.2)(64bit) libnss3.so(NSS_3.11.7)(64bit) libnss3.so(NSS_3.12)(64bit) libnss3.so(NSS_3.12.3)(64bit) libnss3.so(NSS_3.2)(64bit) libnss3.so(NSS_3.3)(64bit) libnss3.so(NSS_3.4)(64bit) libnss3.so(NSS_3.6)(64bit) libnss3.so(NSS_3.9)(64bit) libnssutil3.so()(64bit) libnssutil3.so(NSSUTIL_3.12)(64bit) libplc4.so()(64bit) libplds4.so()(64bit) libpthread.so.0()(64bit) libsmime3.so()(64bit) libsmime3.so(NSS_3.2)(64bit) libsmime3.so(NSS_3.3)(64bit) libssl3.so()(64bit) libssl3.so(NSS_3.14)(64bit) libssl3.so(NSS_3.2)(64bit) libssl3.so(NSS_3.30.0.1)(64bit) libssl3.so(NSS_3.4)(64bit) nss >= 3.28.3 rpmlib(CompressedFileNames) <= 3.0.4-1 rpmlib(FileDigests) <= 4.6.0-1 rpmlib(PayloadFilesHavePrefix) <= 4.0-1 rtld(GNU_HASH) rpmlib(PayloadIsXz) <= 5.2-1 where we see "libssl3.so(NSS_3.30.0.1)(64bit)", the culprit exposed by the TPS tests. Asha informed us that the last known TPS tests to pass were run against jss-4.4.0-1.el7; with Asha's assistance, we slowly stepped backwards to determine that the last JSS to pass TPS tests was "jss-4.4.0-3.el7"; the differences between the rquirements for this build versus the latest are: # diff jss-3-requires jss-6-requires 2c2 < jss-4.4.0-3.el7.x86_64 --- > jss-4.4.0-6.el7.x86_64 33a34 > libssl3.so(NSS_3.30.0.1)(64bit) 35c36 < nss >= 3.21.0 --- > nss >= 3.28.3 It turns out that "jss-4.4.0-4.el7" was the first to utilize the newer version of NSS; in addition to being compiled and linked against nss 3.28.3, the following bugs were changed in "jss-4.4.0-4.el7": * Mon Mar 27 2017 Matthew Harmsen <mharmsen> - 4.4.0-4 - Bugzilla Bug #1394414 - Rebase jss to 4.4.0 in RHEL 7.4 - Updated build requirements for NSPR - Updated build and runtime requirements for NSS - ## 'jss-post-rebase.patch' resolves the following issues ported from - Mozilla Bugzilla #1337092 - CMC conformance update: Implement required ASN.1 code for RFC5272+ (cfu) - Mozilla Bugzilla #1347394 - Eclipse project files for JSS (edewata) - Mozilla Bugzilla #1347429 - Deprecated SSL 3.0 cipher names in SSLSocket class. (edewata) - Mozilla Bugzilla #1348856 - SSL alert callback (edewata) - Mozilla Bugzilla #1349278 - SSL cipher enumeration (edewata) - Mozilla Bugzilla #1349349 - Problem with Password.readPasswordFromConsole(). (edewata) - Mozilla Bugzilla #1349831 - Revise top-level README file (mharmsen) - Mozilla Bugzilla #1349836 - Changes to JSS Version Block (mharmsen) - Mozilla Bugzilla #1350130 - Missing CryptoManager.verifyCertificateNowCUNative() implementation. (emaldona) As this problem exists in jss-4.4.0-4.el7, jss-4.4.0-5.el7, and jss-4.4.0-6.el7,, but not in jss-4.4.0-3.el7, this issue must be caused by either the compilation/link process with NSS 3.28.3, or one of the aforementioned bugs. Since this issue was uncovered as a part of RHEL QE Testing, only this internal bug will be filed until the actual issues is discovered.