From 84c9ccaed34d83b7e97a4890561b1b218d99b1ba Mon Sep 17 00:00:00 2001
From: Brant Knudson <bknudson@us.ibm.com>
Date: Wed, 27 Aug 2014 17:50:19 -0500
Subject: [PATCH] Change cms_sign_data to use sha256 message digest

cms_sign_data was not passing the md parameter to openssl, so it was
using the default digest of sha1. Some security standards require a
SHA2 algorithm for the digest.

This if for security hardening.

SecurityImpact

Change-Id: Iff063149e1f12df69bbf9015222d09d798980872
Closes-Bug: #1362343
---
 keystoneclient/common/cms.py | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/keystoneclient/common/cms.py b/keystoneclient/common/cms.py
index 85fa30715..1c343f68d 100644
--- a/keystoneclient/common/cms.py
+++ b/keystoneclient/common/cms.py
@@ -332,7 +332,8 @@ def cms_sign_data(data_to_sign, signing_cert_file_name, signing_key_file_name,
                                 '-inkey', signing_key_file_name,
                                 '-outform', 'PEM',
                                 '-nosmimecap', '-nodetach',
-                                '-nocerts', '-noattr'],
+                                '-nocerts', '-noattr',
+                                '-md', 'sha256', ],
                                stdin=subprocess.PIPE,
                                stdout=subprocess.PIPE,
                                stderr=subprocess.PIPE)