Bug 1490740 - PK11Store.getEncryptedPrivateKeyInfo() segfault if export fails [rhel-7.4.z]
Summary: PK11Store.getEncryptedPrivateKeyInfo() segfault if export fails [rhel-7.4.z]
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: jss
Version: 7.4
Hardware: All
OS: Linux
urgent
urgent
Target Milestone: rc
: ---
Assignee: Fraser Tweedale
QA Contact: ipa-qe
Petr Bokoc
URL:
Whiteboard:
Depends On: 1460019
Blocks:
TreeView+ depends on / blocked
 
Reported: 2017-09-12 07:33 UTC by Oneata Mircea Teodor
Modified: 2018-07-10 04:14 UTC (History)
13 users (show)

Fixed In Version: jss-4.4.0-8.el7_4
Doc Type: Bug Fix
Doc Text:
Prior to this update, a failure to check that the result of a key wrapping operation was not NULL could in some cases cause PKI to crash due to a segmentation fault. This update adds a check that raises an exception in such cases, and a failed key wrapping operation now results in a Java exceptions instead of a crash.
Clone Of: 1460019
Environment:
Last Closed: 2017-11-30 15:28:58 UTC
Target Upstream Version:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Mozilla Foundation 1371147 0 None None None 2019-03-04 11:03:15 UTC
Red Hat Product Errata RHBA-2017:3300 0 normal SHIPPED_LIVE jss bug fix and enhancement update 2017-11-30 20:14:46 UTC

Description Oneata Mircea Teodor 2017-09-12 07:33:16 UTC
This bug has been copied from bug #1460019 and has been proposed to be backported to 7.4 z-stream (EUS).

Comment 3 Sumedh Sidhaye 2017-09-25 09:36:58 UTC
Please provide steps to reproduce / verify.

Comment 4 Fraser Tweedale 2017-09-25 23:24:11 UTC
Add doc text.

Comment 5 Fraser Tweedale 2017-09-25 23:57:16 UTC
Sumedh, steps to reproduce are to perform a PKCS #12 recovery of
an archived key, on Dogtag installed with Thales nethsm
(in wrapping mode, i.e. kra.allowEncDecrypt.{archival,recovery}=false,
and with kra.legacyPKCS12=false).

The operation is expected to fail, but Dogtag should not crash.

Comment 6 Sumedh Sidhaye 2017-10-04 10:59:50 UTC
Tests run on Thales HSM installation

root@csqa4-guest01 hsm_setup # rpm -qi pki-tools
Name        : pki-tools
Version     : 10.4.1
Release     : 15.el7_4
Architecture: x86_64
Install Date: Tuesday 26 September 2017 06:31:05 AM EDT
Group       : System Environment/Base
Size        : 954171
License     : GPLv2
Signature   : (none)
Source RPM  : pki-core-10.4.1-15.el7_4.src.rpm
Build Date  : Monday 18 September 2017 08:55:34 PM EDT
Build Host  : x86-041.build.eng.bos.redhat.com
Relocations : (not relocatable)
Packager    : Red Hat, Inc. <http://bugzilla.redhat.com/bugzilla>
Vendor      : Red Hat, Inc.
URL         : http://pki.fedoraproject.org/
Summary     : Certificate System - PKI Tools


root@csqa4-guest01 ~ # tail -n 5 /var/lib/pki/rhcs92-KRA-ssidhaye/kra/conf/CS.cfg
usrgrp._002=##
usrgrp.ldap=internaldb
kra.allowEncDecrypt.archival=false
kra.allowEncDecrypt.recovery=false
kra.legacyPKCS12=false


PKCS #12 recovery of an archived key when the above flags are set results in  a Java exception rather than a segmentation fault.

Comment 9 errata-xmlrpc 2017-11-30 15:28:58 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:3300


Note You need to log in before you can comment on or make changes to this bug.