Actions
Bug #23054
closed
Oracle Linux 8 agent segfaults on FIPS system
Pull Request:
Severity:
Critical - prevents main use of Rudder | no workaround | data loss | security
UX impact:
User visibility:
Effort required:
Priority:
0
Name check:
To do
Fix check:
To do
Regression:
No
Description
On Oracle Linux 8 on a FIPS system (STIG installation or something like that), the rudder agent fails with segfault during policy update
The same rules on an Oracle Linux 9 does not break the rudder agent
Update:
- the problem is that FIPS forbids MD5 and that CFEngine uses MD5 to create the node identifier (by key pinning)
- in Oracle 8 we use the system openssl while in Oracle 9 we embed one, so that's why there's a difference in observed behavior
- the workaround would be to also embed openssl in Oracle 8
- the correction is to make CFEngine able to use both MD5 (for compat and migration) and SHA2.
Updated by
Updated by Vincent MEMBRÉ over 1 year ago
- Target version changed from 7.3.4 to 7.3.5
Updated by
Updated by Alexis Mousset over 1 year ago
- Target version changed from 7.3.5 to 7.3.6
Updated by Vincent MEMBRÉ over 1 year ago
- Target version changed from 7.3.6 to 7.3.7
Updated by Vincent MEMBRÉ over 1 year ago
- Target version changed from 7.3.7 to 7.3.8
Updated by Vincent MEMBRÉ about 1 year ago
- Target version changed from 7.3.8 to 7.3.9
Updated by Vincent MEMBRÉ about 1 year ago
- Target version changed from 7.3.9 to 7.3.10
Updated by Vincent MEMBRÉ about 1 year ago
- Target version changed from 7.3.10 to 7.3.11
Updated by Vincent MEMBRÉ 11 months ago
- Target version changed from 7.3.11 to 7.3.12
Updated by Vincent MEMBRÉ 10 months ago
- Target version changed from 7.3.12 to 7.3.13
Updated by Vincent MEMBRÉ 10 months ago
- Target version changed from 7.3.13 to 7.3.14
Updated by Vincent MEMBRÉ 8 months ago
- Target version changed from 7.3.14 to 7.3.15
Updated by Alexis Mousset 8 months ago
- Status changed from New to Resolved
We have developped a workaround with OMNI packages, closing.
Actions