| 2021-10-18 13:17:13 |
Matt Caswell |
bug |
|
|
added bug |
| 2022-03-10 09:46:58 |
Simon Chopin |
nominated for series |
|
Ubuntu Jammy |
|
| 2022-03-10 09:46:58 |
Simon Chopin |
bug task added |
|
openssl (Ubuntu Jammy) |
|
| 2022-03-10 09:46:58 |
Simon Chopin |
nominated for series |
|
Ubuntu Focal |
|
| 2022-03-10 09:46:58 |
Simon Chopin |
bug task added |
|
openssl (Ubuntu Focal) |
|
| 2022-03-10 09:46:58 |
Simon Chopin |
nominated for series |
|
Ubuntu Impish |
|
| 2022-03-10 09:46:58 |
Simon Chopin |
bug task added |
|
openssl (Ubuntu Impish) |
|
| 2022-03-10 10:00:13 |
Simon Chopin |
tags |
|
rls-ff-incoming rls-jj-incoming |
|
| 2022-03-10 10:02:07 |
Simon Chopin |
openssl (Ubuntu Focal): status |
New |
Confirmed |
|
| 2022-03-10 10:02:10 |
Simon Chopin |
openssl (Ubuntu Impish): status |
New |
Confirmed |
|
| 2022-03-10 10:02:13 |
Simon Chopin |
openssl (Ubuntu Jammy): status |
New |
Confirmed |
|
| 2022-03-10 15:26:41 |
Simon Chopin |
tags |
rls-ff-incoming rls-jj-incoming |
rls-jj-incoming |
|
| 2022-03-10 16:33:19 |
Brian Murray |
openssl (Ubuntu Jammy): importance |
Undecided |
Medium |
|
| 2022-03-10 16:33:20 |
Brian Murray |
openssl (Ubuntu Impish): importance |
Undecided |
Medium |
|
| 2022-03-10 16:33:23 |
Brian Murray |
openssl (Ubuntu Focal): importance |
Undecided |
Medium |
|
| 2022-03-24 15:14:30 |
Matthieu Clemenceau |
tags |
rls-jj-incoming |
fr-2135 rls-jj-incoming |
|
| 2022-03-24 16:21:26 |
Brian Murray |
tags |
fr-2135 rls-jj-incoming |
fr-2135 |
|
| 2022-04-05 12:10:23 |
Matt Caswell |
bug watch added |
|
https://github.com/openssl/openssl/issues/18047 |
|
| 2022-05-25 12:49:45 |
Launchpad Janitor |
merge proposal linked |
|
https://code.launchpad.net/~schopin/ubuntu/+source/openssl/+git/openssl/+merge/423153 |
|
| 2022-05-30 14:25:21 |
Simon Chopin |
description |
Launching openssl s_server as follows:
$ openssl s_server -nocert -psk 01020304 -dtls1
And using openssl s_client to connect to it like this:
$ openssl s_client -dtls1 -psk 01020304
Results in s_server entering an infinite loop:
Using default temp DH parameters
ACCEPT
ERROR
140247926990208:error:141FC044:SSL routines:tls_setup_handshake:internal error:../ssl/statem/statem_lib.c:109:
ERROR
140247926990208:error:141FC044:SSL routines:tls_setup_handshake:internal error:../ssl/statem/statem_lib.c:109:
ERROR
...and so on...
I have confirmed that upstream OpenSSL does not have this issue in a default build of 1.1.1j or 1.1.1k. Upstream 1.1.1l has a different bug with these commands (https://github.com/openssl/openssl/issues/16707) and it was while working on the fix for that issue (https://github.com/openssl/openssl/pull/16838) that I noticed this problem in the Ubuntu packages.
$ lsb_release -rd
Description: Ubuntu 21.04
Release: 21.04
$ apt-cache policy openssl
openssl:
Installed: 1.1.1j-1ubuntu3.5
Candidate: 1.1.1j-1ubuntu3.5
Version table:
*** 1.1.1j-1ubuntu3.5 500
500 http://gb.archive.ubuntu.com/ubuntu hirsute-updates/main amd64 Packages
500 http://security.ubuntu.com/ubuntu hirsute-security/main amd64 Packages
100 /var/lib/dpkg/status
1.1.1j-1ubuntu3 500
500 http://gb.archive.ubuntu.com/ubuntu hirsute/main amd64 Packages
$ openssl version -a
OpenSSL 1.1.1j 16 Feb 2021
built on: Mon Aug 23 17:02:39 2021 UTC
platform: debian-amd64
options: bn(64,64) rc4(16x,int) des(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -ffile-prefix-map=/build/openssl-5U8yxE/openssl-1.1.1j=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_TLS_SECURITY_LEVEL=2 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
OPENSSLDIR: "/usr/lib/ssl"
ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1"
Seeding source: os-specific |
[Impact]
The TLS test server `openssl s_server` can very easily be led into an
infinite loop if configured with incompatible settings and used via
DTLS. This makes it harder to test one's TLS configuration.
[Test plan]
In one session:
$ openssl s_server -nocert -psk 01020304 -dtls1
In parallel:
$ openssl s_client -dtls1 -psk 01020304
The server session will enter an infinite loop:
Using default temp DH parameters
ACCEPT
ERROR
140247926990208:error:141FC044:SSL routines:tls_setup_handshake:internal error:../ssl/statem/statem_lib.c:109:
ERROR
140247926990208:error:141FC044:SSL routines:tls_setup_handshake:internal error:../ssl/statem/statem_lib.c:109:
ERROR
... etc...
[Where problems could occur]
The patch is fairly self-contained, so regressions should only occur in
the `openssl s_server` application, and not in the libssl or libcrypto
libraries.
However, the patch could break said server, which might be used in e.g.
autopkgtests.
[Original report]
Launching openssl s_server as follows:
$ openssl s_server -nocert -psk 01020304 -dtls1
And using openssl s_client to connect to it like this:
$ openssl s_client -dtls1 -psk 01020304
Results in s_server entering an infinite loop:
Using default temp DH parameters
ACCEPT
ERROR
140247926990208:error:141FC044:SSL routines:tls_setup_handshake:internal error:../ssl/statem/statem_lib.c:109:
ERROR
140247926990208:error:141FC044:SSL routines:tls_setup_handshake:internal error:../ssl/statem/statem_lib.c:109:
ERROR
...and so on...
I have confirmed that upstream OpenSSL does not have this issue in a default build of 1.1.1j or 1.1.1k. Upstream 1.1.1l has a different bug with these commands (https://github.com/openssl/openssl/issues/16707) and it was while working on the fix for that issue (https://github.com/openssl/openssl/pull/16838) that I noticed this problem in the Ubuntu packages.
$ lsb_release -rd
Description: Ubuntu 21.04
Release: 21.04
$ apt-cache policy openssl
openssl:
Installed: 1.1.1j-1ubuntu3.5
Candidate: 1.1.1j-1ubuntu3.5
Version table:
*** 1.1.1j-1ubuntu3.5 500
500 http://gb.archive.ubuntu.com/ubuntu hirsute-updates/main amd64 Packages
500 http://security.ubuntu.com/ubuntu hirsute-security/main amd64 Packages
100 /var/lib/dpkg/status
1.1.1j-1ubuntu3 500
500 http://gb.archive.ubuntu.com/ubuntu hirsute/main amd64 Packages
$ openssl version -a
OpenSSL 1.1.1j 16 Feb 2021
built on: Mon Aug 23 17:02:39 2021 UTC
platform: debian-amd64
options: bn(64,64) rc4(16x,int) des(int) blowfish(ptr)
compiler: gcc -fPIC -pthread -m64 -Wa,--noexecstack -Wall -Wa,--noexecstack -g -O2 -ffile-prefix-map=/build/openssl-5U8yxE/openssl-1.1.1j=. -flto=auto -ffat-lto-objects -fstack-protector-strong -Wformat -Werror=format-security -DOPENSSL_TLS_SECURITY_LEVEL=2 -DOPENSSL_USE_NODELETE -DL_ENDIAN -DOPENSSL_PIC -DOPENSSL_CPUID_OBJ -DOPENSSL_IA32_SSE2 -DOPENSSL_BN_ASM_MONT -DOPENSSL_BN_ASM_MONT5 -DOPENSSL_BN_ASM_GF2m -DSHA1_ASM -DSHA256_ASM -DSHA512_ASM -DKECCAK1600_ASM -DRC4_ASM -DMD5_ASM -DAESNI_ASM -DVPAES_ASM -DGHASH_ASM -DECP_NISTZ256_ASM -DX25519_ASM -DPOLY1305_ASM -DNDEBUG -Wdate-time -D_FORTIFY_SOURCE=2
OPENSSLDIR: "/usr/lib/ssl"
ENGINESDIR: "/usr/lib/x86_64-linux-gnu/engines-1.1"
Seeding source: os-specific |
|
| 2022-06-04 11:26:20 |
Launchpad Janitor |
openssl (Ubuntu): status |
Confirmed |
Fix Released |
|
| 2022-06-08 15:33:56 |
Łukasz Zemczak |
openssl (Ubuntu Jammy): status |
Confirmed |
Fix Committed |
|
| 2022-06-08 15:33:57 |
Łukasz Zemczak |
bug |
|
|
added subscriber Ubuntu Stable Release Updates Team |
| 2022-06-08 15:33:59 |
Łukasz Zemczak |
bug |
|
|
added subscriber SRU Verification |
| 2022-06-08 15:34:03 |
Łukasz Zemczak |
tags |
fr-2135 |
fr-2135 verification-needed verification-needed-jammy |
|
| 2022-06-14 11:13:52 |
Simon Chopin |
tags |
fr-2135 verification-needed verification-needed-jammy |
fr-2135 verification-done-jammy verification-needed |
|
| 2022-06-14 17:24:57 |
Brian Murray |
openssl (Ubuntu Impish): status |
Confirmed |
Fix Committed |
|
| 2022-06-14 17:25:02 |
Brian Murray |
tags |
fr-2135 verification-done-jammy verification-needed |
fr-2135 verification-done-jammy verification-needed verification-needed-impish |
|
| 2022-06-14 17:27:27 |
Brian Murray |
openssl (Ubuntu Focal): status |
Confirmed |
Fix Committed |
|
| 2022-06-14 17:27:32 |
Brian Murray |
tags |
fr-2135 verification-done-jammy verification-needed verification-needed-impish |
fr-2135 verification-done-jammy verification-needed verification-needed-focal verification-needed-impish |
|
| 2022-06-20 14:32:33 |
Launchpad Janitor |
openssl (Ubuntu Jammy): status |
Fix Committed |
Fix Released |
|
| 2022-06-20 14:32:41 |
Łukasz Zemczak |
removed subscriber Ubuntu Stable Release Updates Team |
|
|
|
| 2022-06-21 07:11:58 |
Simon Chopin |
tags |
fr-2135 verification-done-jammy verification-needed verification-needed-focal verification-needed-impish |
fr-2135 verification-done-focal verification-done-jammy verification-needed verification-needed-impish |
|
| 2022-06-21 07:16:54 |
Simon Chopin |
tags |
fr-2135 verification-done-focal verification-done-jammy verification-needed verification-needed-impish |
fr-2135 verification-done verification-done-focal verification-done-impish verification-done-jammy |
|
| 2022-06-21 14:32:30 |
Launchpad Janitor |
openssl (Ubuntu Impish): status |
Fix Committed |
Fix Released |
|
| 2022-06-21 14:32:30 |
Launchpad Janitor |
cve linked |
|
2022-1292 |
|
| 2022-06-21 14:32:30 |
Launchpad Janitor |
cve linked |
|
2022-2068 |
|
| 2022-06-21 14:32:31 |
Launchpad Janitor |
openssl (Ubuntu Focal): status |
Fix Committed |
Fix Released |
|
