Alexander Scheel

Allow old certs to be cross-signed

1

In Vault 1.11, we introduced cross-signing support, but the earlier SKID field change in Vault 1.10 causes problems: notably, certs created on older versions of Vault (

This option is known to cause problems with large numbers of issued certificates. Ensure admins are warned about the impact of this field and encourage them to disable it. `Signed-off-by:...

When solving with assumptions, it would be nice to expose [conflicts](https://github.com/msoos/cryptominisat/blob/master/src/cryptominisat.h.in#L69) from CryptoMiniSat's C++ API in Python.

Ctrl+C doesn't work in pycryptosat

1

When a program uses `pycryptosat`, it'll fail to respond to the `Ctrl+C` shortcut because the native component of `pycryptosat`, `SATSolver` from CryptoMiniSat, doesn't invoke Python's signal handler. Demonstration: ```python3 from...

Broaden sshd_use_approved_* to non-FIPS use cases

10

#### Description Allow `sshd_use_approved_ciphers` to satisfy both FIPS and non-FIPS use cases with the same rule. Benchmarks like CIS encourage the usage of approved cipher suites as well (and do...

Enable CA nonce protection

2

Disabling CA nonce protection prohibits Dogtag CA from performing CSRF protection, making some XSS vulnerabilities trivially reflected. We need to ensure this is enabled by default to limit the scope...

#### Description of Problem: As described in the [ComplianceAsCode SCE pull request](https://github.com/ComplianceAsCode/content/pull/7075#issuecomment-875438084), we'd like to see multiple SCE scripts combined into a single `extended-components` with multiple `script` sub-elements. Suggested by...

#### Description of Problem: When [adding SCE support in ComplianceAsCode](https://github.com/ComplianceAsCode/content/pull/7075#discussion_r664664758), @yuumasato noticed that the final datastream has a non-compliant `` element with non-empty body (see linked comment). This appears to...

Not applicable not counted in results top bar

1

#### Description of Problem: Consider two different versions of content, where some rules are not applicable:   In particular, both had 283 rules...

Add missing XCCDF Profile selection remark to HTML report

8

#### Description of Problem: I was discussing how to add commentary to a tailoring file the other day on `#openscap`. I suggested adding a `remark` under the `select` element of...