# changelog

author: Rich Megginson <rmeggins@redhat.com> 1.1.3-1
changelog:
  - the new and improved 1.1.3 release - FedoraConsoleFramework_1_1_3 FedoraConsoleFramework_1_1_3_20081222


author: Rich Megginson <rmeggins@redhat.com> 1.1.3-5
changelog:
  - add build requires and requires for java 1.6.0 - otherwise get this error during build:
  - [javac] bad class file: /usr/lib/java/jss4.jar(org/mozilla/jss/ssl/SSLSocket.class)
  - [javac] class file has wrong version 50.0, should be 49.0


author: Christina Fu <cfu@redhat.com> - 4.2.6-9.el5idm
changelog:
  - bug 654657 - <jdennis@redhat.com>
    Incorrect socket accept error message due to bad pointer arithmetic
  - bug 661142 - <cfu@redhat.com>
    Verification should fail when a revoked certificate is added


author: Andrew Wnuk <awnuk@redhat.com> - 4.2.6-15
changelog:
  - bug 676083 - JSS: slots not freed
    This patch is based on release 9, which is newer than release 10.


author: Jack Magne <jmagne@redhat.com> - 4.2.6-15.99
changelog:
  - bug 694661 - TKS instance crash during token enrollment.
    Back out of previous patch for #676083.


author: Christina Fu <cfu@redhat.com> - 4.2.6-16.99.
changelog:
  - Bug 670980 - Cannot create system certs when using LunaSA HSM in FIPS Mode and ECC algorithms (support tokens that don't do ECDH)


author: Christina Fu <cfu@redhat.com> - 4.2.6-18.999
changelog:
  - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping
    unwrapping keys should be done in the token
  - support for PKCS5v2; support for secure PKCS12


author: Matthew Harmsen <mharmsen@redhat.com> - 4.2.6-19.99
changelog:
  - Bugzilla Bug #715621 - Defects revealed by Coverity scan
  - inserting patch prior to jss-PBE-PKCS5-V2-secure-P12.patch


author: Christina Fu <cfu@redhat.com> - 4.2.6-20.99
changelog:
  - Bugzilla Bug #744797 - KRA key recovery (retrieve pkcs#12) fails after the
    in-place upgrade( CS 8.0->8.1)


author: Christina Fu <cfu@redhat.com> - 4.2.6-22.99
changelog:
  - Bugzilla Bug #745278 - [RFE] ECC encryption keys cannot be archived
    ECC phase2 work - support for ECC encryption key archival and recovery (cfu)
  - Bugzilla Bug #797352 - Un-deprecate previously deprecated methods in
    JSS 4.2.6 . . . (mharmsen)
  - Dogtag TRAC Task #109 (https://fedorahosted.org/pki/ticket/109) - add
    benign JNI jar file symbolic link from JNI libdir to JNI jar file (mharmsen)


author: Matthew Harmsen <mharmsen@redhat.com> - 4.2.6-23.99
changelog:
  - Bugzilla Bug #797352 - Un-deprecate previously deprecated methods in
    JSS 4.2.6 . . . BadPaddingException (mharmsen)


author: Christina Fu <cfu@redhat.com> - 4.2.6-25.99
changelog:
  - Bugzilla 744207 - Key archival fails when KRA is configured with lunasa.
  - Bugzilla Bug #952500 CMCAuth fails with error "CMCAuth:
    java.security.NoSuchAlgorithmException" when using NetHSM token
  - added source URLs in spec file to pass Package Wrangler


author: Margaret Lum <mlum@redhat.com> 4.2.4-41.el5idm
changelog:
  - Build with IBM JVM 1.4.2.  Rebuild.  Added LD_PRELOAD back in for 232224.
  - Updated BuildRequires for java-1.4.2-ibm.


author: Matthew Harmsen <mharmsen@redhat.com> 4.2.5-1.el5idm
changelog:
  - Updated JSS version to 4.2.5.
  - Updated BuildRequires for nspr-devel >= 4.6.99
  - Updated BuildRequires for nss-devel >= 3.12.0
  - Updated BuildRequires for java-devel >= 1.6.0
  - Updated BuildRequires for pkgconfig
  - Force BuildRequires to use java-devel-openjdk >= 1.6.0 (OpenJDK 1.6.0)
  - Updated Requires for nss >= 3.12.0
  - Updated Requires for java >= 1.6.0


author: Christina Fu <cfu@redhat.com> 4.2.6-1.el5idm
changelog:
  - Bugzilla Bug #455305 -  CA ECC Signing Key Failure
  - Bugzilla Bug #502111 -  Need JSS interface for NSS's
    PK11_GenerateKeyPairWithOpFlags() function
  - Bugzilla Bug #503809 -  Update JSS version to 4.2.6
  - Bugzilla Bug #503817 -  Create JSS Javadocs as their own RPM


author: Matthew Harmsen <mharmsen@redhat.com> 4.2.6-2.el5idm
changelog:
  - Bugzilla Bug #503809 -  Update JSS version to 4.2.6 (use correct tarball)
  - Update License string to be more specific on versions (rcritten@redhat.com)
  - Include patch to fix missing @param in javadocs (rcritten@redhat.com)
  - Added signature verification


author: Ade Lee <alee@redhat.com> 1.0.0-14
changelog:
  - Resolves: #643546 - [RFE] Add nuxwdog to RHEL.
  - Remove old encryption scheme
  - Store passwords in kernel keyring


author: Matthew Harmsen <mharmsen@redhat.com> 1.1.0-21
changelog:
  - Bugzilla Bug #487896 - Introduce optional 'base_phase' release tag to
    denote ".alpha", ".beta", etc.


author: Matthew Harmsen <mharmsen@redhat.com> 8.0.0-30
changelog:
  - Bugzilla Bug #512134 -  strip symbols from libraries, modules,
    and executables
  - Release Candidate 4a build


author: Christina Fu <cfu@redhat.com> 8.0.0-15
changelog:
  - Bugzilla Bug #455305 - CA ECC signing Key Failure
    Bugzilla Bug #223279 - ECC: Ca: unable to perform agent auth on a machine with nCipher ECC HSM


author: Ade Lee <alee@redhat.com> 8.0.1-1
changelog:
  - Update version for errata containing Bugzilla bugs 224688, 512828, 513450, 
    514093, 514094, 514270


author: Christina Fu <cfu@redhat.com> 8.0.1-2
changelog:
  - Bugzilla Bug #465507 - Enhancement: Support SHA2 + EC signature algorithms
  - Added to errata RHBA-2009:8830 containing Bugzilla Bugs 224688, 512828,
    513450, 514093, 514094, 514270, 465507, 518431


author: Ade Lee <alee@redhat.com> 8.0.4-1
changelog:
  - Bugzilla Bug #545935 - Add new client-auth ee port to address CVE-2009-3555 
    TLS: MITM attacks via session renegotiation


author: Ade Lee <alee@redhat.com> 8.0.5-1
changelog:
  - Bugzilla Bug #545935 - Add new client-auth ee port to address CVE-2009-3555 
    TLS: MITM attacks via session renegotiation. Add missing servlet mapping.


author: Ade Lee <alee@redhat.com> 8.0.6-1
changelog:
  - Bugzilla Bug #545935 - Add new client-auth ee port to address CVE-2009-3555 
    TLS: MITM attacks via session renegotiation. Add postinstall changes.


author: Ade Lee <alee@redhat.com> 8.1.0-5
changelog:
  - Bugzilla Bug #703324 - rhcs81beta - uri redirection from / to /ca/ee/ca
    with blank page if Java security manager is active (alee)
  - Bugzilla Bug #649910 - Console: an auditor or agent can be added to an
    administrator group. (jmagne)


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.0-6
changelog:
  - Bugzilla Bug #703324 - rhcs81beta - uri redirection from / to /ca/ee/ca
    with blank page if Java security manager is active
  - Bugzilla Bug #707416 - CC_LAB_EVAL: Security Domain: missing audit msgs
    for modify/add
  - Bugzilla Bug #708297 - Incorrect info shown for Server Version in pkiconsole


author: Christina Fu <cfu@redhat.com> 8.1.0-9
changelog:
  - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping
    unwrapping keys should be done in the token


author: Jack Magne <jmagne@rehdat.com> 8.1.1-1
changelog:
  - Bugzilla Bug #854824 - CA instance creation fails on a newly provisioned RHEL 5.9 - 'Could not initialize class java.util.logging.LogManager'.


author: Christina Fu <cfu@redhat.com> 8.1.5-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and 
    bug fix update (BETA)
  - Bugzilla Bug #963073 - rhcs81 tps crash for CN over than 64 bytes (jmagne)
  - Bugzilla Bug #902952 - RFE: Cert System 8.1 - Revocation routing with TPS
    and multiple non-cloned CAs (cfu)
  - TRAC Ticket #575 - [RFE] TPS Recovery Enhancement - Framework &
    Prototype (cfu)
  - TRAC Ticket #576 - [RFE] TPS Recovery Enhancement - Cert/Key Injection and 
    Deletion (jmagne)
  - Bugzilla Bug #927312 - [RFE] Allow recovery of non-encryption certs
    to token (cfu, jmagne)
    - Phase 2a: Delegation Feature + prototype
    - Cert/Key injection feature initial check-in
    - actual ldap record retrieval code for ExternalReg DB instead
      of prototype
    - removed certsToDelete reference to go fully with "alternative" base
      design 
    - code patch to accept (serial,caID) without keyid and drmID,
      to support non-archivable keys
    - include feature to selectively delete certs from the token
    - add params to handle format for TPS profile delegateISEtoken


author: Jack Magne <jmagne@redhat.com> 8.1.6-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and
    bug fix update (BETA)
  - Bugzilla Bug 1025830 - TPS ExternalReg: new Token delegate enrollment profiles contain duplicate profile setid (cfu)


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.7-1
changelog:
  - Bugzilla Bug #1280391 - Provide the user the ability to import their
    own CA certificate with private key (cfu, jmagne, mharmsen)


author: Dogtag Team <pki-devel@redhat.com> 8.1.9-1
changelog:
  - Changes for RHCS 8.1.8
  - Bugzilla Bug #1262000 - Certificate Revocation Reasons not being updated in
    some cases (cfu)
  - Bugzilla Bug #1280391 - Provide the user the ability to import their
    own CA certificate with private key (cfu, jmagne, mharmsen)
  - Bugzilla Bug #1290650 - CRL generation enters loop when CA loses
    connection to netHSM


author: Dogtag Team <pki-devel@redhat.com> 8.1.9-2
changelog:
  - Dependency changes:  pki-util-8.1.2-2, pki-common-8.1.19-2,
                         redhat-pki-ca-ui-8.1.1-2


author: Matthew Harmsen <mharmsen@redhat.com> 8.0.0-8
changelog:
  - Bugzilla Bug #250874 -Change spec file dependencies to rely on latest
    versions of components (NSPR, NSS, JSS, MOD_NSS)


author: Andrew Wnuk <awnuk@redhat.com> 8.0.1-2
changelog:
  - Update version for errata RHBA-2009:8830-01 to include 224688, 512828, 513450,
    514093, 514094, 514270 and 518431


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.0-14
changelog:
  - Bugzilla Bug #720510 - Console: Adding a certificate into nethsm throws
    "Token not found" error. (alee)
  - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an
    ECC CA to generate ECC certs from CRMF (jmagne)
  - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any
    component value which is equal to its default value (alee)
  - Bugzilla Bug #722989 - Registering an agent when a subsystem is created -
    does not log AUTHZ_SUCCESS event. (alee)


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.0-15
changelog:
  - Bugzilla Bug #717041 - Improve escaping of some enrollment inputs like
    (jmagne, awnuk)
  - Bugzilla Bug #724848 - CC_LAB_EVAL: none-FIPS ciphers allowed in CC mode
    (cfu)


author: Ade Lee <alee@redhat.com> 8.1.0-16
changelog:
  - Bugzilla Bug #731741 - some CS.cfg nickname parameters not updated
    correctly when subsystem cloned (using hsm)


author: Ade Lee <alee@redhat.com> 8.1.0-17
changelog:
  - Bugzilla Bug #733446 - In-place upgrade - Upgrading nuxwdog packages throws error,
    updated nuxwdog dependencies


author: Jack Magne <jmagne@redhat.com> 8.1.0-18
changelog:
  - Bugzilla Bug #730162 - TPS/TKS token enrollment failure in FIPS mode
    (hsm+NSS). (jmagne)
  - Bugzilla Bug #737218 - Incorrect request attribute name matching ignores
    request attributes during request parsing. (awnuk)


author: Andrew Wnuk <awnuk@redhat.com> 8.1.0-20
changelog:
  - Bugzilla Bug #747019 - Migrated policy requests from 7.1->8.1 displays
    issuedcerts and cert_Info params as base 64 blobs.


author: Jack Magne <jmagne@redhat.com> 8.1.0-21
changelog:
  - Bugzilla Bug #748570 - CA console does not display Local certificates info
    when one of the cert in security db has long nickname string.


author: Christina Fu <cfu@redhat.com> 8.1.0-22
changelog:
  - Bugzilla Bug #769739 - CC: self test verifySystemCertByNickname: certain
    failure will not cause server to shutdown as expected


author: Christina Fu <cfu@redhat.com> 8.1.0-23
changelog:
  - Bugzilla Bug #769739 - CC: self test verifySystemCertByNickname: certain
    failure will not cause server to shutdown as expected (changed variable name)


author: Ade Lee <alee@redhat.com> 8.1.2-1
changelog:
  - Bugzilla Bug #852855 - remove unexpected anonymous binds to internal db in 
    cert status thread. Fixed in errata 13744


author: Jack Magne <jmagne@rehdat.com> 8.1.3-1
changelog:
  - Bugzilla Bug #852855 - remove unexpected anonymous binds to internal db in
    cert status thread. Fixed in errata 13744. Apply latest fix to issue.


author: Christina Fu <cfu@redhat.com> 8.1.10-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and
    bug fix update (BETA)
  - Bugzilla Bug #963073 - rhcs81 tps crash for CN over than 64 bytes (jmagne)
  - Bugzilla Bug #902952 - RFE: Cert System 8.1 - Revocation routing with TPS
    and multiple non-cloned CAs (cfu)
  - TRAC Ticket #575 - [RFE] TPS Recovery Enhancement - Framework &
    Prototype (cfu)
  - TRAC Ticket #576 - [RFE] TPS Recovery Enhancement - Cert/Key Injection and
    Deletion (jmagne)
  - Bugzilla Bug #927312 - [RFE] Allow recovery of non-encryption certs
    to token (cfu, jmagne)
    - Phase 2a: Delegation Feature + prototype
    - Cert/Key injection feature initial check-in
    - actual ldap record retrieval code for ExternalReg DB instead
      of prototype
    - removed certsToDelete reference to go fully with "alternative" base
      design 
    - code patch to accept (serial,caID) without keyid and drmID,
      to support non-archivable keys
    - include feature to selectively delete certs from the token
    - add params to handle format for TPS profile delegateISEtoken


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.10-2
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and
    bug fix update (BETA)
  - explicitly set BuildRequires of 'pki-util = 8.1.1-1.el5pki' to prevent a
    conflict caused by building two simultaneous erratas for the same version
    of RHEL which require different version dependencies


author: Christina Fu <cfu@redhat.com> 8.1.11-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and
    bug fix update (BETA)
  - Bugzilla Bug #1013080 - Temporary token enrollment fails for a user whose
    token has been temporarily lost


author: Jack Magne <jmagne@rehdat.com> 8.1.12-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and
    bug fix update (BETA) 
  - Bugzilla Bug 1028048 - TPS Fails to recover revoked Certs with long chain (cfu)


author: Ade Lee <alee@redhat.com> 8.1.14-1
changelog:
  - Bugzilla Bug 1150142 - TPS Cert database inconsistency (dsirrine)
  - Bugzilla Bug 1186896 - NIST SP800-108 KDF (cfu for community member)
  - Bugzilla Bug 1134405 - CRL Publishing fails after Java heap OOM error.
    (cfu, nkinder)


author: Christina Fu <cfu@redhat.com> 8.1.15-1
changelog:
  - Bugzilla Bug #1134405 - CRL generation stops working after publishing gets
    no response from LDAP


author: Christina Fu <cfu@redhat.com> 8.1.18-1
changelog:
  - Bugzilla Bug #1324987 - [TMS] do not store some fields in KRA archival
    request records on ldap (part 2 - debug log)


author: Dogtag Team <pki-devel@redhat.com> 8.1.19-1
changelog:
  - Changes for RHCS 8.1.8
  - Bugzilla Bug #1262000 - Certificate Revocation Reasons not being updated in
    some cases (cfu)
  - Bugzilla Bug #1280391 -  Provide the user the ability to import their own CA
    certificate with private key (cfu, jmagne, mharmsen)
  - Bugzilla Bug #1324987 - [TMS] do not store some fields in KRA archival
    request records on ldap (cfu)


author: Dogtag Team <pki-devel@redhat.com> 8.1.20-1
changelog:
  - Bugzilla Bug #1456030 - CVE-2017-7509 certificate system 8: Enrolling
    certificate without certreq field causes CA to crash (jmagne)


author: Jack Magne <jmagne@redhat.com> 8.1.3-2
changelog:
  - Bugzilla Bug #864397 - (CVE-2012-4543) EMBARGOED CVE-2012-4543 Certificate System: Multiple cross-site 
  - scripting flaws by displaying CRL or processing profile.


author: Matthew Harmsen <mharmsen@redhat.com> 8.0.0-4
changelog:
  - Aligned RHEL 5, RHEL 4, and Solaris 9 "base_release" numbers
  - Bugzilla Bug #445402 - Changed "base_url" from
                           "http://www.redhat.com/software/rha/certificate" to
                           "http://www.redhat.com/certificate_system"


author: Jack Magne <jmagne@redhat.com> 8.1.0-3
changelog:
  - Bugzilla Bug #689453 - CRMFPopClient request to CA's unsecure port throws
    file not found exception.


author: Christina Fu <cfu@redhat.com> 8.1.0-10
changelog:
  - Bugzilla Bug #737122 - DRM: during archiving and recovering, wrapping
    unwrapping keys should be done in the token: TMS recovery part.


author: Dogtag Team <pki-devel@redhat.com> 8.1.7-1
changelog:
  - Changes for RHCS 8.1.8
  - Bugzilla Bug #1324987 - [TMS] do not store some fields in KRA archival
    request records on ldap (cfu)


author: Matthew Harmsen <mharmsen@redhat.com> 8.0.0-8
changelog:
  - Bugzilla Bug #485790 -  Need changes made to spec files in various packages
    to be able to build in koji/brew


author: Ade Lee <alee@redhat.com> 8.1.0-6
changelog:
  - Bugzilla Bug #706306 - scripts to allow in-place migration from 8.0 to 8.1
    needed (add scripts to spec file)


author: Andrew Wnuk <awnuk@redhat.com> 8.1.0-8
changelog:
  - Bugzilla Bug #733521 - In-place upgrade -- TUS Operators group should be
    created during directory server upgrade


author: Ade Lee <alee@redhat.com> 8.1.0-9
changelog:
  - Bugzilla Bug #704299 - Some TKS and KRA ACLs incorrect after upgrade
    from RHCS8 to RHCS8.1beta
  - Bugzilla Bug #738794 - In-place upgrade 8.0 -> 8.1: after the upgrade
    ca services page is missing frame contents


author: Andrew Wnuk <awnuk@redhat.com> 8.1.0-10
changelog:
  - Bugzilla Bug #598728 - rhcs80 after 7.1 migration - cannot view request
    containing http params
  - Bugzilla Bug #737216 - unnecessary empty lines in "cert-info" attributes
    created in 7.1->8.0 migration
  - Bugzilla Bug #737217 - Migration tool is not using proper "ext-data"
    array format.


author: Matthew Harmsen <mharmsen@redhat.com> 8.0.0-8
changelog:
  - Bugzilla Bug #483699 -  problem with the epoch in the spec file causes
    build to fail
  - Bugzilla Bug #483695 - unable to build osutil in brew


author: Ade Lee <alee@redhat.com> 8.1.0-5
changelog:
  - Bugzilla Bug #706306 - scripts to allow in-place migration from 8.0 to 8.1
  - Bugzilla Bug #717765 - TPS configuration: logging into security domain
    from tps does not work with clientauth=want


author: Ade Lee <alee@redhat.com> 8.1.0-7
changelog:
  - Bugzilla Bug #771797 - sslget does not work after FEDORA-2011-17400 update,
    breaking FreeIPA install


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.0-6
changelog:
  - Bugzilla Bug #703324 - rhcs81beta - uri redirection from / to /ca/ee/ca
    with blank page if Java security manager is active
  - Bugzilla Bug #708297 - Incorrect info shown for Server Version in pkiconsole


author: Christina Fu <cfu@redhat.com> 8.1.0-8
changelog:
  - Bugzilla Bug #769060 - Self-tests fail at OCSP subsystem restart -- with
    null CertNickName in the audit output


author: Ade Lee <alee@redhat.com> 8.1.0-6
changelog:
  - Bugzilla Bug #717765 - TPS configuration: logging into security domain
    from tps does not work with clientauth=want


author: Ade Lee <alee@redhat.com> 8.0.0-1
changelog:
  - Bugzilla Bug #480679 - integrate latest selinux code with the rest
    of the build infrastructure 
  - Initial release


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.0-1
changelog:
  - Bugzilla Bug #475895 - Disallow creation of an initial login shell
  - Bugzilla Bug #512234 - Move pkiuser:pkiuser check from spec file into
    pkicreate . . .


author: Ade Lee <alee@redhat.com> 8.1.0-4
changelog:
  - Bugzilla Bug #728377 - pkiremove parses password.conf incorrectly for
    unconfigured java subsystems, causing prompt for token pwd


author: Dogtag Team <pki-devel@redhat.com> 8.1.2-1
changelog:
  - Changes for RHCS 8.1.8
  - Bugzilla Bug #1280391 -  Provide the user the ability to import their own CA certificate with private key (cfu, jmagne, mharmsen)


author: Ade Lee <alee@redhat.com> 8.1.0-11
changelog:
  - Bugzilla Bug #707095 - tps delete user operation should check for roles
    (not have them passed in) (alee)


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.0-12
changelog:
  - Bugzilla Bug #717813 - EV_AUDIT_LOG_SHUTDOWN audit log not generated
    for tps and ca on server shutdown (alee, jmagne)
  - Bugzilla Bug #717765 - TPS configuration: logging into security domain
    from tps does not work with clientauth=want (alee)


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.0-13
changelog:
  - Bugzilla Bug #725572 - Starting TPS subsystem with no pre-existing
    audit log file does not write audit messages. (jmagne)
  - Bugzilla Bug #724848 - CC_LAB_EVAL: none-FIPS ciphers allowed in CC mode
    (cfu)


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.0-16
changelog:
  - Bugzilla Bug #737184 - TPS UI display admin user name as
    "undefined TUS Administrator". (awnuk)
  - Bugzilla Bug #735191 - in ou=tokens, token_type not getting updated
    if a card is changed from one type to another (awnuk)
  - Bugzilla Bug #741795 - SSL Ldap connection test at startup fails under
    FIPS mode. (jmagne)


author: Andrew Wnuk <awnuk@redhat.com> 8.1.3-3
changelog:
  - Bugzilla Bug #923039 - CVE-2013-1885 Certificate System: pki-tps XSS flaw
  - Bugzilla Bug #924870 - CVE-2013-1886 Certificate System: pki-tps format string injection


author: Andrew Wnuk <awnuk@redhat.com> 8.1.3-4
changelog:
  - Bugzilla Bug #923039 - CVE-2013-1885 Certificate System: pki-tps XSS flaw - updated patch
  - Bugzilla Bug #924870 - CVE-2013-1886 Certificate System: pki-tps format string injection


author: Andrew Wnuk <awnuk@redhat.com> 8.1.3-5
changelog:
  - Bugzilla Bug #923039 - CVE-2013-1885 Certificate System: pki-tps XSS flaw - updated patch
  - Bugzilla Bug #924870 - CVE-2013-1886 Certificate System: pki-tps format string injection
  - Bugzilla Bug #959514 - TPS UI lists and searches are not displaying results


author: Christina Fu <cfu@redhat.com> 8.1.8-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and 
    bug fix update (BETA)
  - Bugzilla Bug #927312 - [RFE] Allow recovery of non-encryption certs
    to token - fixed a missing cert issue


author: Jack Magne <jmagne@redhat.com> 8.1.9-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and 
    bug fix update (BETA)
  - Bugzilla Bug #927312 - [RFE] Allow recovery of non-encryption certs
    to token
    - added applet that allows many certs on the token


author: Christina Fu <cfu@redhat.com> 8.1.10-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and 
    bug fix update (BETA)
  - Bugzilla Bug #927312 - [RFE] Allow recovery of non-encryption certs to
    token - added applet that allows many certs on the token (jmagne)
  - Bugzilla Bug #927312 - [RFE] Allow recovery of non-encryption certs to
    token, address valgrind memory issues. (jmagne)
  - Bugzilla Bug #1012079 - [CS 8.1 October Beta] Format requires authenticaiton
    when externalReg is enabled (cfu)
  - Bugzilla Bug #1009205 - TPS Recovery Feature, failure to update token db
    after recovery operation (jmagne)
  - Bugzilla Bug #1010262 - TPS Audit does not record information of Certs
    recovered/deleted on the token when using TPS Key recovery feature (jmagne)
  - Bugzilla Bug #1010012 - Certs are Not recovered on to token when using
    externalRegAddToToken (jmagne)
  - Bugzilla Bug #1011256 - TPS External Registration, Handle Recovery Error
    conditions Better (jmagne)
  - Bugzilla Bug #955660 - Improve token transition from temp_lost to
    temp_lost_perm_lost (jmagne)
  - Bugzilla Bug #1011244 - Key Recovery Enhancement - Breaks use of
    allowedTokenTransition check (jmagne)
  - Bugzilla Bug #1012700 - TPS ExternalReg: recovering revoked cert restarts
    TPS (cfu)
  - Bugzilla Bug #1012971 - [CS 8.1 October Beta] External Registration does not
    handle large serial numbers (cfu)
  - Bugzilla Bug #1011813 - Enrolling a token using ESC with externalReg
    disabled causes token labelname to be empty (cfu)


author: Jack Magne <jmagne@redhat.com> 8.1.11-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and
    bug fix update (BETA)
  - Bugzilla Bug 1011086 - Unable to update the applet version on Gemalto token to 1.4.52043a23. (jmagne)
  - Bugzilla Bug 1020998 - Token Key Recovery routine not reporting all errors. (jmagne)
  - Bugzilla Bug 1020027 - Missing configuration settings causes issues with recovering private keys (cfu).


author: Jack Magne <jmagne@redhat.com> 8.1.12-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and
    bug fix update (BETA)
  - Bugzilla Bug 1023593 - Handle recovery of large number of certs memory failure better (jmagne)
  - Bugzilla Bug 1023235 - TPS ExternalReg: certs get revoked during failure (jmagne)
  - Bugzilla Bug 1023196 - With ExternalReg enabled, Private keys that's not associated with the Encryption cert can be recovered (cfu)
  - Bugzilla Bug 1022389 - Unable to recover certs using delegateIEtoken with tokenCUID specified (cfu)
  - Bugzilla Bug 1023170 - Unable to Enroll token with userKey profile when externalReg is enabled (jmagne)


author: Jack Magne <jmagne@redhat.com> 8.1.13-1
changelog:
  - RHEA-2013:15017-01 Red Hat Certificate System (TMS) enhancement and
    bug fix update (BETA)
  - Bugzilla Bug 1029127 - Enrolled with externalReg tokentype - re-insert smart card, ESC shows phone home configuration dialog box (jmagne)
  - Bugzilla Bug 1028181 - Failed to retain an encryption cert on the token when re-enrolling. (jmagne)
  - Bugzilla Bug 1029167 - Tokentype externalRegAddToToken token transition and configuration issues (jmagne)
  - Bugzilla Bug 1029201 - Provide default configuration for latest Key Recovery applet. (jmagne)
  - Bugzilla Bug 1028048 - TPS Fails to recover revoked Certs with long chain (cfu)


author: Ade Lee <alee@redhat.com> 8.1.15-1
changelog:
  - Bugzilla Bug 1184961 - Code Cleanup in TPS (alee)
  - Bugzilla Bug 1186896 - NIST SP800-108K (cfu for community member)
  - Bugzilla Bug 1163867 - Add granualarity to token termination (alee, dsirrine)
  - Updated applet(s) for PIN retries feature (jmagne for community member)


author: Ade Lee <alee@redhat.com> 8.1.16-1
changelog:
  - Bugzilla Bug 1196844 - Provide ability to perform off-card key generation for
    non-encryption token keys
  - Bug 1196839 - Provide tokenType mapping in external registration


author: Christina Fu <cfu@redhat.com> 8.1.18-1
changelog:
  - Bugzilla Bug #1203290 - parameter op.format.userKey.cuidMustMatchKDD is set
    to true by default which causes smartcard format failure


author: Christina Fu <cfu@redhat.com> 8.1.21-1
changelog:
  - Bugzilla Bug #1163867 - [RFE] Add granularity to token termination in TPS
    (change revokeExpired default to false)


author: Christina Fu <cfu@redhat.com> 8.1.22-1
changelog:
  - Bugzilla Bug #1163867 - [RFE] Add granularity to token termination in TPS
  - Bugzilla Bug #1200107 - Recovering of a revoked cert erroneously reflects
    "active" in the token db cert entry
  - Bugzilla Bug #1196844 - [RFE] Provide ability to perform off-card key
    generation for non-encryption token keys (re-test only due to other bug
    changes - jmagne)


author: Christina Fu <cfu@redhat.com> 8.1.24-1
changelog:
  - Bugzilla Bug #1200107 - Recovering of a revoked cert erroneously reflects
    "active" in the token db cert entry (typo fixes)


author: Jack Magne <jmagne@redhat.com> 8.1.25-1
changelog:
  - Bugzilla Bug #1241706 - tokenType hard coded to 'userKey' for pin resets in RA_Pin_Reset_Processor.cpp for external registration


author: Jack Magne <jmagne@redhat.com> 8.1.2-1
changelog:
  - Bug 844800 - TPS should provide the ability to not allow tokens marked as 'Terminated' to be formatted and reused.


author: Jack Magne <jmagne@redhat.com> 8.1.3-1
changelog:
  - Bug Bug 844800 - TPS should provide the ability to not allow tokens marked as 'Terminated' to be formatted and reused.
    Update to give a default value for the operations transition list.


author: Jack Magne <jmagne@rehdat.com> 8.1.3-2
changelog:
  - Bugzilla Bug #863272 - rhcs81 tps httpd segfault on interrupted token format operations.
  - Bugzilla Bug #864607 - Empty certificate search in TPS results in httpd.worker segmentation fault then server error.


author: Christina Fu <cfu@redhat.com> 8.1.26-1
changelog:
  - Bugzilla Bug #1302116 - enrolling an active token does not clear that token
    (patch provided by customer)


author: Dogtag Team <pki-devel@redhat.com> 8.1.29-1
changelog:
  - Changes for RHCS 8.1.8
  - Bugzilla Bug #1302103 -  The TPS does not properly communicate
    symmetricKeys.requiredVersion to the TKS (cfu)
  - Bugzilla Bug #1302116 - enrolling an active token does not clear that token
    (cfu)
  - Bugzilla Bug #1320283 - TPS throws "err=6" when attempting to format and
    enroll G&D Cards (jmagne)
  - Bugzilla Bug #1324987 - [TMS] do not store some fields in KRA archival
    request records on ldap (cfu)
  - Bugzilla Bug #1327653 - Token memory not wiped after key deletion (jmagne)
  - Bugzilla Bug #1382376 - Applet upgrade during rekey operation results in
    formatted token. (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 8.1.30-1
changelog:
  - Bugzilla Bug #1302103 -  The TPS does not properly communicate
    symmetricKeys.requiredVersion to the TKS (cfu)


author: Christina Fu <cfu@redhat.com> 8.0.2-1
changelog:
  - Bugzilla Bug #527593 - more robust signature digest alg, like SHA256 instead
    of SHA1 for ECC and RSA


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.0-4
changelog:
  - Bugzilla Bug #719007 - Key Constraint keyParameter being ignored using an
    ECC CA to generate ECC certs from CRMF (jmagne)
  - Bugzilla Bug #716307 - rhcs80 - DER shall not include an encoding for any
    component value which is equal to its default value (alee)


author: Jack Magne <jmagne@redhat.com> 8.1.0-7
changelog:
  - Bugilla Bug #832212 - CA certificate can be removed via Certificate Manager.
    Fix provided by Edewata.


author: Dogtag Team <pki-devel@redhat.com> 8.1.2-1
changelog:
  - Changes for RHCS 8.1.8
  - Bugzilla Bug #1282589 - RHCS error when agent tries to look at requests
    (jmagne)


author: Dogtag Team <pki-devel@redhat.com> 8.1.3-1
changelog:
  - Bugzilla Bug #1454414 - ECDSA Certificates Generated by Certificate System
    8.1 fail NIST validation test with parameter field (cfu)


author: Matthew Harmsen <mharmsen@redhat.com> 8.1.0-3
changelog:
  - Bugzilla Bug #695015 - Serial No. of a revoked certificate is not
    populated in the CA signedAudit messages (jmagne)
  - Bugzilla Bug #694143 - CA Agent not returning specified request (awnuk)


author: Ade Lee <alee@redhat.com> 8.1.0-4
changelog:
  - Bugzilla Bug #706306 - added preinstall script to allow in-place upgrades
  - Bugzilla Bug #704351 - remove help buttons in agent and ee UI in all subsystems


author: Andrew Wnuk <awnuk@redhat.com> 8.1.0-8
changelog:
  - Bugzilla Bug #747381 - After the migration (7.1->8.1) CA agent page displays
    admin cert request with authtime attribute twice


author: Dogtag Team <pki-devel@redhat.com> 8.1.1-1
changelog:
  - Changes for RHCS 8.1.8
  - Bugzilla Bug #854420 -  Agent and EE certificate searches based on time have
    "fixed" year range. (awnuk)


author: Matthew Harmsen <mharmsen@redhat.com> 8.0.0-14
changelog:
  - Bugzilla Bug #492735 -  Configuration wizard stores certain incorrect
    port values within TPS "CS.cfg" . . .
  - Bugzilla Bug #495597 -  Unable to access Agent page using a configured
    CA/KRA containing an HSM


author: Matthew Harmsen <mharmsen@redhat.com> 8.0.0-15
changelog:
  - Bugzilla Bug #492735 -  Configuration wizard stores certain incorrect
    port values within TPS "CS.cfg" . . .


author: Matthew Harmsen <mharmsen@redhat.com> 8.0.0-16
changelog:
  - Bugzilla Bug #500498 -  CA installation wizard doesn't install
    administrator cert into browser on Firefox 3


author: Matthew Harmsen <mharmsen@redhat.com> 8.0.0-8
changelog:
  - Bugzilla Bug #488388 -  copyright notices - remove from UI
  - Bugzilla Bug #440543 -  CA's web-services page needs improvements


author: Ade Lee <alee@redhat.com> 8.1.0-6
changelog:
  - Bugzilla Bug #714068 - KRA: remove monitor servlet from kra
  - Bugzilla Bug #706306 - scripts to allow in-place migration from 8.0 to 8.1


author: Jack Magne <jmagne@redhat.com> 8.0.0-26
changelog:
  - Bugzilla Bug #491019 - Security Officer: Format Card operation to format a user card 
    also formats a security officer card.


author: Ade Lee <alee@redhat.com> 8.1.0-3
changelog:
  - Bugzilla Bug# 691447 - TPS UI Admin tab 'Add new token' opens a page with
    text 'Agent operations: Add new tokens'
  - Bugzilla Bug #691867 - TPS configuration fails with SSL
    at 'Authentication Database' due to failure of signature verification


author: Jack Magne <jmagne@redhat.com> 8.1.0-4
changelog:
  - Bugzilla Bug #491008 - Security Officer: Format Card, Set Home URL and
    Format SO card has 'home phone URL'


author: Jack Magne <jmagne@redhat.com> 1.2.1-1
changelog:
  - Bugzilla Bug #849027 - rhcs81 tks failed start in selftest
    sharedsessionkey - symkey PK11_Derive.


author: Jack Magne <jmagne@redhat.com> 1.2.6.1
changelog:
  - Bugzilla 1186896 - NIST SP800-108 KDF (cfu for community member) - remove harmful bit of sanity checking, not needed.


author: Christina Fu <cfu@redhat.com> 1.1.0-14
changelog:
  - Bugzilla Bug #455305 - CA ECC signing Key Failure
    Bugzilla Bug #223279 - ECC: Ca: unable to perform agent auth on a machine with nCipher ECC HSM
  - This log entry does not apply to tomcatjss.  Ignore.


author: Ade Lee <alee@redhat.com> 1.1.3-1
changelog:
  - Bugzilla BZ536891 - If wrong passwords are presented to pki subsystems, 
    restart of the subsytem hangs indefintely (password.conf related)
    Add nuxwdog-client-java build dependency
    Update build numbers


