Fails to connect to servers that disable SSLv3

[Marius Gedminas]

SRU REQUEST:

[Impact]

Xchat-Gnome (and xchat) for the use of SSLv3. Since the Poodle attack on SSLv3, many servers are now disabling the use of SSLv3, making xchat-gnome unsable to connect successfully.

[Test Case]

Install xchat-gnome and connect to an irc server that no longer offers SSLv3.

[Regression Potential]

This update may possibly introduce compatibility issues with sites that don't properly handle TLSv1.2 negotiations. While such sites existed in the past, they aren't likely to be common at the present time. Unfortunately, there is no ultimate solution that would be compatible with both scenarios.

Original report:

slack.com is a chat service with optional IRC integration. Since today I can no longer connect to their IRC gateway using XChat-GNOME. The error is:

> * Nepavyko prisijungti. Klaida: (336130315) error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
> Ar tai tikrai SSL šifravimą palaikantis serveris ir prievadas?

which, translated from lt_LT, means

> * Cannot connect. Error: (336130315) error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number
> Does the server/port really support SSL?

I think this is part of the fallout of CVE-2014-3566 (aka POODLE). XChat-GNOME is trying to use the insecure SSL protocol version 3, and Slack, reasonably enough, rejects that.

ProblemType: Bug
DistroRelease: Ubuntu 14.04
Package: xchat-gnome 1:0.30.0~git20131003.d20b8d+really20110821-0.2ubuntu12
ProcVersionSignature: Ubuntu 3.13.0-37.64-generic 3.13.11.7
Uname: Linux 3.13.0-37-generic x86_64
ApportVersion: 2.14.1-0ubuntu3.5
Architecture: amd64
CurrentDesktop: GNOME
Date: Wed Oct 15 14:50:57 2014
EcryptfsInUse: Yes
InstallationDate: Installed on 2012-07-25 (811 days ago)
InstallationMedia: Ubuntu 12.04 LTS "Precise Pangolin" - Release amd64 (20120425)
SourcePackage: xchat-gnome
UpgradeStatus: Upgraded to trusty on 2014-04-18 (180 days ago)

[Marc Deslauriers (mdeslaur)]

Hi mgedmin,

Could you please test the fixed package I've uploaded to my testing PPA here:

https://launchpad.net/~mdeslaur/+archive/ubuntu/testing

If that works for you to connect to irc.slack.com, I'll work on preparing an SRU.

Thanks!

[Marius Gedminas (mgedmin)]

xchat-gnome 0.30.0~git20131003.d20b8d+really20110821-0.2ubuntu12.1~ppa1 from your PPA works for me.

[Launchpad Janitor (janitor)]

This bug was fixed in the package xchat-gnome - 1:0.30.0~git20131003.d20b8d+really20110821-0.2ubuntu14

---------------
xchat-gnome (1:0.30.0~git20131003.d20b8d+really20110821-0.2ubuntu14) utopic; urgency=medium

  * Don't force the use of SSLv3 (LP: #1381484)
    - debian/patches/dont_force_sslv3.patch: use SSLv23_client_method() so
      the best method gets automatically negotiated in src/common/ssl.c.
 -- Marc Deslauriers <email address hidden> Mon, 20 Oct 2014 10:14:47 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package xchat - 2.8.8-7.1ubuntu7

---------------
xchat (2.8.8-7.1ubuntu7) utopic; urgency=medium

  * Don't force the use of SSLv3 (LP: #1381484)
    - debian/patches/dont_force_sslv3.patch: use SSLv23_client_method()
      so the best method gets automatically negotiated in
      src/common/ssl.c.
 -- Steve Beattie <email address hidden> Mon, 20 Oct 2014 10:54:31 -0400

[Chris J Arges (arges)]

Hello Marius, or anyone else affected,

Accepted xchat-gnome into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/xchat-gnome/1:0.30.0~git20131003.d20b8d+really20110821-0.2ubuntu12.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris J Arges (arges)]

Hello Marius, or anyone else affected,

Accepted xchat into trusty-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/xchat/2.8.8-7.1ubuntu5.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Chris J Arges (arges)]

Hello Marius, or anyone else affected,

Accepted xchat into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/xchat/2.8.8-3ubuntu12.1 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Marius Gedminas (mgedmin)]

I can confirm that xchat-gnome 0.30.0~git20131003.d20b8d+really20110821-0.2ubuntu12.1 from your trusty-proposed works for me.

[Launchpad Janitor (janitor)]

This bug was fixed in the package xchat - 2.8.8-3ubuntu12.1

---------------
xchat (2.8.8-3ubuntu12.1) precise; urgency=medium

  * Don't force the use of SSLv3 (LP: #1381484)
    - debian/patches/dont_force_sslv3.patch: use SSLv23_client_method()
      so the best method gets automatically negotiated in
      src/common/ssl.c.
 -- Marc Deslauriers <email address hidden> Mon, 20 Oct 2014 11:56:17 -0400

[Chris J Arges (arges)]

The verification of the Stable Release Update for xchat has completed successfully and the package has now been released to -updates. Subsequently, the Ubuntu Stable Release Updates Team is being unsubscribed and will not receive messages about this bug report. In the event that you encounter a regression using the package from -updates please report a new bug using ubuntu-bug and tag the bug report regression-update so we can easily find any regressions.

[Launchpad Janitor (janitor)]

This bug was fixed in the package xchat-gnome - 1:0.30.0~git20131003.d20b8d+really20110821-0.2ubuntu12.1

---------------
xchat-gnome (1:0.30.0~git20131003.d20b8d+really20110821-0.2ubuntu12.1) trusty; urgency=medium

  * Don't force the use of SSLv3 (LP: #1381484)
    - debian/patches/dont_force_sslv3.patch: use SSLv23_client_method() so
      the best method gets automatically negotiated in src/common/ssl.c.
 -- Marc Deslauriers <email address hidden> Mon, 20 Oct 2014 10:30:21 -0400

[Launchpad Janitor (janitor)]

This bug was fixed in the package xchat - 2.8.8-7.1ubuntu5.1

---------------
xchat (2.8.8-7.1ubuntu5.1) trusty; urgency=medium

  * Don't force the use of SSLv3 (LP: #1381484)
    - debian/patches/dont_force_sslv3.patch: use SSLv23_client_method()
      so the best method gets automatically negotiated in
      src/common/ssl.c.
 -- Marc Deslauriers <email address hidden> Mon, 20 Oct 2014 11:55:26 -0400

[Chris J Arges (arges)]

Hello Marius, or anyone else affected,

Accepted xchat-gnome into precise-proposed. The package will build now and be available at http://launchpad.net/ubuntu/+source/xchat-gnome/1:0.30.0~git20110821.e2a400-0.2ubuntu4.2 in a few hours, and then in the -proposed repository.

Please help us by testing this new package. See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Your feedback will aid us getting this update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug, mentioning the version of the package you tested, and change the tag from verification-needed to verification-done. If it does not fix the bug for you, please add a comment stating that, and change the tag to verification-failed. In either case, details of your testing will help us make a better decision.

Further information regarding the verification process can be found at https://wiki.ubuntu.com/QATeam/PerformingSRUVerification . Thank you in advance!

[Ubuntu Foundations Team Bug Bot (crichton)]

The fix for this bug has been awaiting testing feedback in the -proposed repository for precise for more than 90 days. Please test this fix and update the bug appropriately with the results. In the event that the fix for this bug is still not verified 15 days from now, the package will be removed from the -proposed repository.

[Marius Gedminas (mgedmin)]

I booted an Ubuntu 12.04 LTS desktop live session with testdrive, apt-get installed xchat-gnome version 1:0.30.0~git20110821.e2a400-0.2ubuntu4.2 and attempted to connect slack.com's IRC gateway.

The connection was successful.

[Launchpad Janitor (janitor)]

This bug was fixed in the package xchat-gnome - 1:0.30.0~git20110821.e2a400-0.2ubuntu4.2

---------------
xchat-gnome (1:0.30.0~git20110821.e2a400-0.2ubuntu4.2) precise; urgency=medium

  * Don't force the use of SSLv3 (LP: #1381484)
    - debian/patches/dont_force_sslv3.patch: use SSLv23_client_method() so
      the best method gets automatically negotiated in src/common/ssl.c.
 -- Marc Deslauriers <email address hidden> Mon, 20 Oct 2014 10:32:45 -0400