RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
Bug 1579202 - JSS has wrong encoding for ecdsa with sha* AlgorithmIdentifier [rhel-7.5.z]
Summary: JSS has wrong encoding for ecdsa with sha* AlgorithmIdentifier [rhel-7.5.z]
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: jss
Version: 7.6
Hardware: All
OS: Linux
high
high
Target Milestone: rc
: ---
Assignee: Christina Fu
QA Contact: Asha Akkiangady
Marc Muehlfeld
URL:
Whiteboard:
Depends On: 1575725
Blocks:
TreeView+ depends on / blocked
 
Reported: 2018-05-17 07:20 UTC by Oneata Mircea Teodor
Modified: 2018-06-26 16:52 UTC (History)
5 users (show)

Fixed In Version: jss-4.4.0-12.el7_5
Doc Type: Bug Fix
Doc Text:
Previously, the ECDSA with SHA* signature Algorithm ID in Java Security Services (JSS) allowed for NULL parameter. As a consequence, the certificates did not conform with RFC 5758. The problem has been fixed. As a result, JSS works as expected.
Clone Of: 1575725
Environment:
Last Closed: 2018-06-26 16:52:16 UTC
Target Upstream Version:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2018:1989 0 None None None 2018-06-26 16:52:20 UTC

Description Oneata Mircea Teodor 2018-05-17 07:20:12 UTC 
This bug has been copied from bug #1575725 and has been proposed to be backported to 7.5 z-stream (EUS).
Comment 2 Matthew Harmsen 2018-05-21 18:18:01 UTC 
commit a8e371e54b009159e9e3a0d198bd5eb3ed68ac22 (HEAD -> master, origin/master, origin/HEAD)
Author: Christina Fu <cfu>
Date:   Tue May 15 14:58:07 2018 -0700

    Ticket 3 JSS has wrong encoding for ecdsa with sha* AlgorithmIdentifier
    This ticket addresses the issue to meet RFC 5758 where param field must be omitted
    in the ECDSA Signature algorithm' AlgorithmIdentifier for
    ecdsa-withSHA224, ecdsa-with-SHA256, ecdsa-with-SHA384, or ecdsa-with-SHA512.
    
    fixes https://pagure.io/jss/issue/3
Comment 3 Matthew Harmsen 2018-05-21 20:31:38 UTC 
Christina Fu 2018-05-15 18:51:47 EDT

Test procedure:
Note, this could be tested with https://bugzilla.redhat.com/show_bug.cgi?id=1547802
No need to test it twice.

Se see the following for test procedure:
https://bugzilla.redhat.com/show_bug.cgi?id=1547802#c2
Comment 5 Geetika Kapoor 2018-06-15 08:47:24 UTC 
Hi Christina,

We have recently moved BZ https://bugzilla.redhat.com/show_bug.cgi?id=1581382 for review and investigation.Since this bug depends on BZ 1581382,  what should I do with this Bugzilla?

Thanks,
Geetika
Comment 6 Christina Fu 2018-06-15 22:53:42 UTC 
change of plan:
https://bugzilla.redhat.com/show_bug.cgi?id=1581382#c13
Comment 7 Asha Akkiangady 2018-06-15 23:15:55 UTC 
Marking the bug verified as per comment #6.
Comment 9 Christina Fu 2018-06-21 23:29:26 UTC 
Marc, in response to your email...
"allows for NULL parameter" has to do with the data structure of the AlgorithmID.

I don't think it means anything to most people.  Maybe it's too much detail to even try to add doc text for such low level routine.
I suggest we just leave the doc text as is. 
btw, I just noticed one copy/paste error earlier when I switch words around.  I have corrected it.
Comment 11 errata-xmlrpc 2018-06-26 16:52:16 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2018:1989
Note You need to log in before you can comment on or make changes to this bug.