Bug 1685618 - logging-es using cryptographically weak hashing algorithm.
Summary: logging-es using cryptographically weak hashing algorithm.
Alias: None
Product: OpenShift Container Platform
Classification: Red Hat
Component: Logging
Version: 3.11.0
Hardware: Unspecified
OS: Unspecified
Target Milestone: ---
: 3.11.z
Assignee: Jeff Cantrill
QA Contact: Anping Li
Depends On: 1684332
Blocks: 1686135
TreeView+ depends on / blocked
Reported: 2019-03-05 16:45 UTC by Jeff Cantrill
Modified: 2019-04-11 05:38 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Cause: The remote service is using a SSL/TLS certificate in the certificate chain that has been signed using a cryptographically weak hashing algorithm Consequence: Increased vulnerability Fix: Update to a stronger hashing algorithm Result: Improved security
Clone Of: 1684332
: 1686135 (view as bug list)
Last Closed: 2019-04-11 05:38:34 UTC
Target Upstream Version:

Attachments (Terms of Use)

System ID Private Priority Status Summary Last Updated
Github openshift openshift-ansible pull 11300 0 None closed bug 1685618. Modify default_md for logging cert generation 2020-07-23 09:28:29 UTC
Red Hat Product Errata RHBA-2019:0636 0 None None None 2019-04-11 05:38:43 UTC

Description Jeff Cantrill 2019-03-05 16:45:40 UTC
+++ This bug was initially created as a clone of Bug #1684332 +++

Description of problem:
SSL/TLS: Certificate Signed Using A Weak Signature Algorithm

How reproducible:
Customer using Vulnerability scanning tool to get this issue report

Below is the details:
The remote service is using a SSL/TLS certificate in the certificate chain that has been signed
using a cryptographically weak hashing algorithm.

Vulnerability Detection Result
The following certificates are part of the certificate chain but using insecure
,→signature algorithms:
Signature Algorithm: sha1WithRSAEncryption

Solution type: Mitigation
Servers that use SSL/TLS certificates signed with a weak SHA-1, MD5, MD4 or MD2 hashing
algorithm will need to obtain new SHA-2 signed SSL/TLS certificates to avoid web browser
SSL/TLS certificate warnings.

Vulnerability Insight
The following hashing algorithms used for signing SSL/TLS certificates are considered crypto-
graphically weak and not secure enough for ongoing use:
- Secure Hash Algorithm 1 (SHA-1)
- Message Digest 5 (MD5)
- Message Digest 4 (MD4)
- Message Digest 2 (MD2)
Beginning as late as January 2017 and as early as June 2016, browser developers such as Microsoft
and Google will begin warning users when visiting web sites that use SHA-1 signed Secure Socket
Layer (SSL) certificates.
NOTE: The script preference allows to set one or more custom SHA-1 fingerprints of CA certifi-
cates which are trusted by this routine. The fingerprints needs to be passed comma-separated
and case-insensitive:

Vulnerability Detection Method
Check which hashing algorithm was used to sign the remote SSL/TLS certificate.
Details:SSL/TLS: Certificate Signed Using A Weak Signature Algorithm
Version used: $Revision: 8810 $

Comment 2 Qiaoling Tang 2019-03-25 07:42:43 UTC
Fix is in openshift-ansible-3.11.98-1

Comment 4 errata-xmlrpc 2019-04-11 05:38:34 UTC
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.


Note You need to log in before you can comment on or make changes to this bug.