Project

General

Profile

Actions
Copy link

Bug #23128

closed

Deface uses MD5 and doesn't work in FIPS-enable environment

Added by Ivan Necas almost 7 years ago. Updated over 6 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
-
Category:
Security
Target version:
-
Difficulty:
Triaged:
No
Bugzilla link:
Pull request:
https://github.com/theforeman/foreman-packaging/pull/3044
Fixed in Releases:
1.20.0
Found in Releases:
Red Hat JIRA:

Description

How to reproduce:

1. install a plugin that uses deface (e.g. katello, foreman_remote_execution…)
2. use the web server or call `rake apipie:cache:index`

Results:

MD5 is used by deface with the following backtrace:

 | /opt/theforeman/tfm/root/usr/share/gems/gems/deface-1.2.0/lib/deface/action_view_extensions.rb:55:in `method_name'
 | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/template.rb:157:in `block in render'
 | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/activesupport-5.1.4/lib/active_support/notifications.rb:168:in `instrument'
 | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/template.rb:352:in `instrument_render_template'
 | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/template.rb:155:in `render'
 | /opt/theforeman/tfm/root/usr/share/gems/gems/deface-1.2.0/lib/deface/action_view_extensions.rb:41:in `render'
 | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/renderer/template_renderer.rb:64:in `render_with_layout'
 | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/renderer/template_renderer.rb:50:in `render_template'
 | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/renderer/template_renderer.rb:14:in `render'
 | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/renderer/renderer.rb:42:in `render_template'
 | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/renderer/renderer.rb:23:in `render'
 | /opt/theforeman/tfm-ror51/root/usr/share/gems/gems/actionview-5.1.4/lib/action_view/helpers/rendering_helper.rb:32:in `render'
 | /opt/theforeman/tfm/root/usr/share/gems/gems/apipie-rails-0.5.6/lib/tasks/apipie.rake:121:in `block in render_page'

Related issues 2 (0 open — 2 closed)

Blocks Foreman - Feature #3511: As a security person, I would like Foreman to run in FIPS modeResolvedActions
Blocked by Foreman - Feature #22119: Replace MD5 hashes with SHAClosedIvan NecasActions
Actions
Copy link
 #1

Updated by Ivan Necas almost 7 years ago

  • Blocks Feature #3511: As a security person, I would like Foreman to run in FIPS mode added
Actions
Copy link
 #2

Updated by Anonymous almost 7 years ago

  • Status changed from New to Assigned
  • Assignee set to Anonymous
Actions
Copy link
 #3

Updated by Anonymous almost 7 years ago

Actions
Copy link
 #4

Updated by Anonymous over 6 years ago

The PR has been merged, new release is pending.

Actions
Copy link
 #5

Updated by Ivan Necas over 6 years ago

Additional patch from testing https://github.com/spree/deface/pull/183

Actions
Copy link
 #6

Updated by Ewoud Kohl van Wijngaarden over 6 years ago

  • Subject changed from Deface uses MD5 and doesn't work in FIPS-enable envrionment to Deface uses MD5 and doesn't work in FIPS-enable environment
  • Status changed from Assigned to New
  • Assignee deleted (Anonymous)
Actions
Copy link
 #7

Updated by Ivan Necas over 6 years ago

Actions
Copy link
 #8

Updated by Ivan Necas over 6 years ago

  • Pull request https://github.com/theforeman/foreman-packaging/pull/3044 added

New deface to support this properly has been just released

Actions
Copy link
 #9

Updated by Anonymous over 6 years ago

  • Status changed from New to Resolved
  • Fixed in Releases 1.20.0 added

RPMs and DEBs got updated.

Actions
Copy link
 #10

Updated by Tomer Brisker over 6 years ago

  • Category set to Security
Actions
Copy link

Also available in: Atom PDF