Actions
Bug #23363
closed
Katello uses md5hash function incompatible with FIPS-enabled environments
Description
This came out after enabling FIPS mode on the underlying rhel 7 with already installed foreman+katello (using a workaround that overrides Digest::MD5 class and logs which gem used it), any content-related task logs the following. I know the FIPS support is currently blocked on the Pulp side, though I'm rising this katello issue issue beforehand:
2018-04-20T05:03:45 [W|app|ec60e] FIPS issue: calling 'new' from | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-3.7.0/app/lib/katello/util/data.rb:9:in `md5hash' | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-3.7.0/app/models/katello/content_view.rb:648:in `generate_cp_environment_id' | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-3.7.0/app/models/katello/content_view.rb:457:in `add_environment' | /opt/theforeman/tfm/root/usr/share/gems/gems/katello-3.7.0/app/lib/actions/katello/content_view/add_to_environment.rb:10:in `plan' | /opt/theforeman/tfm/root/usr/share/gems/gems/dynflow-1.0.0/lib/dynflow/action.rb:493:in `block (3 levels) in execute_plan' | /opt/theforeman/tfm/root/usr/share/gems/gems/dynflow-1.0.0/lib/dynflow/middleware/stack.rb:26:in `pass' | /opt/theforeman/tfm/root/usr/share/gems/gems/dynflow-1.0.0/lib/dynflow/middleware.rb:18:in `pass' | /opt/theforeman/tfm/root/usr/share/gems/gems/dynflow-1.0.0/lib/dynflow/middleware.rb:35:in `plan' | /opt/theforeman/tfm/root/usr/share/gems/gems/dynflow-1.0.0/lib/dynflow/middleware/stack.rb:22:in `call' | /opt/theforeman/tfm/root/usr/share/gems/gems/dynflow-1.0.0/lib/dynflow/middleware/stack.rb:26:in `pass' | /opt/theforeman/tfm/root/usr/share/gems/gems/dynflow-1.0.0/lib/dynflow/middleware.rb:18:in `pass' | /opt/theforeman/tfm/root/usr/share/gems/gems/dynflow-1.0.0/lib/dynflow/middleware.rb:35:in `plan' ...
Updated by Peter Ondrejka about 6 years ago
- Related to Feature #3511: As a security person, I would like Foreman to run in FIPS mode added
Updated by The Foreman Bot about 6 years ago
- Status changed from New to Ready For Testing
- Assignee set to Anonymous
- Pull request https://github.com/Katello/katello/pull/7335 added
Updated by Anonymous almost 6 years ago
- Status changed from Ready For Testing to Closed
- % Done changed from 0 to 100
Applied in changeset katello|39b472d5b91c75573bd7b07157e21b942ef3c8ae.
Updated by Jonathon Turel almost 6 years ago
- translation missing: en.field_release set to 338
Updated by Ivan Necas over 5 years ago
- Related to Bug #25080: Regenerate VCR casettes after changing the defualt hashing algorithm added
Actions