Red Hat ENTERPRISE 5.4 RELEASE NOTES, Руководство пользователя

Страница: 198 / 466

Chapter 1. Package Updates
180
Dan Kaminsky found that browsers still accept certificates with MD2 hash signatures, even though
MD2 is no longer considered a cryptographically strong algorithm. This could make it easier for an
attacker to create a malicious certificate that would be treated as trusted by a browser. NSS now
disables the use of MD2 and MD4 algorithms inside signatures by default. (
CVE-2009-2409
1277
)
All users of nspr and nss are advised to upgrade to these updated packages, which resolve these
issues and add an enhancement.
1.156.2. RHBA-2009:1161: bug fix and enhancement update
Note
This update has already been released (prior to the GA of this release) as errata
RHBA-2009:1161
1278
Updated nspr and nss packages that fix several bugs and add an enhancement are now available
Netscape Portable Runtime (NSPR) provides platform independence for non-GUI operating system
facilities. These facilities include threads, thread synchronization, normal file and network I/O, interval
timing, calendar time, basic memory management (malloc and free), and shared library linking.
Network Security Services (NSS) is a set of libraries designed to support the cross-platform
development of security-enabled client and server applications. Applications built with NSS can
support SSLv2, SSLv3, TLS, and other security standards.
These updated packages upgrade nss from the previous version, 3.12.2, to a prerelease of version
3.12.4. The version of nspr has also been upgraded, from 4.7.3 to 4.7.4. These version upgrades
provide fixes for the following bugs:
SSL client authentication failed against an Apache server when it was using the mod_nss module and
configured for NSSOCSP.
On the client side, the user agent received an error message that referenced "Error Code: -12271" and
stated that establishing an encrypted connection had failed because the certificate had been rejected
by the host.
On the server side, the nss_error_log under /var/log/httpd/ contained the following message: "[error]
Re-negotiation handshake failed: Not accepted by client!?"
Also, /var/log/httpd/error_log contained this error message: "SSL Library Error: -8071 The OCSP
server experienced an internal error."
With these updated packages, the dependency problem which caused this failure has been resolved
so that SSL client authentication with an Apache web server using mod_nss which is configured for
NSSOCSP succeeds as expected. Note that if the presented client certificate is expired, then access
is denied, the user agent is presented with an error message about the invalid certificate, and the
OCSP queries are seen in the OCSP responder. Also, similar OCSP status verification happens for
SSL server certificates used in Apache upon instance start or restart. (
BZ#499052
1279
)
1277
https://www.redhat.com/security/data/cve/CVE-2009-2409.html
1279
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=499052