Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.bugs.dist > #917537 > unrolled thread

Bug#908567: libssl 1.1.1 TLS_MAX_VERSION ABI breakage

Back to article view | Back to linux.debian.bugs.dist

Contents

  Bug#908567: libssl 1.1.1 TLS_MAX_VERSION ABI breakage Jan-Marek Glogowski <glogow@fbihome.de> - 2018-09-11 11:10 +0200
    Bug#907774: Bug#908567: libssl 1.1.1 TLS_MAX_VERSION ABI breakage Adrian Bunk <bunk@debian.org> - 2018-09-11 12:10 +0200
    Bug#908567: [Pkg-openssl-devel] Bug#908567: libssl 1.1.1 TLS_MAX_VERSION ABI breakage Kurt Roeckx <kurt@roeckx.be> - 2018-09-11 19:20 +0200

#917537 — Bug#908567: libssl 1.1.1 TLS_MAX_VERSION ABI breakage

Package: libssl1.1
Version: 1.1.1~~pre9-1
Severity: important

I'm on buster and with the latest updates from yesterday came qtbase-opensource-src 5.11.1+dfsg-7
and SSL started to fail in Qt5 programs. This was reported in bug 907774 ~ 2 weeks ago.

Basically libssl 1.1.1 (in whatever 1.1.1 version - my guess is 1.1.1~~pre9-1 from the changelog)
changed the definition of TLS_MAX_VERSION from TLS1_2_VERSION to TLS1_3_VERSION, which will start to
break all software in buster using that symbol, until libssl1.1 moves to buster.

[toc] | [next] | [standalone]

#917546 — Bug#907774: Bug#908567: libssl 1.1.1 TLS_MAX_VERSION ABI breakage

Control: severity 908567 serious
Control: severity 907774 serious
Control: block 907774 by 908567

On Tue, Sep 11, 2018 at 11:00:00AM +0200, Jan-Marek Glogowski wrote:
> Package: libssl1.1
> Version: 1.1.1~~pre9-1
> Severity: important
> 
> I'm on buster and with the latest updates from yesterday came qtbase-opensource-src 5.11.1+dfsg-7
> and SSL started to fail in Qt5 programs. This was reported in bug 907774 ~ 2 weeks ago.
> 
> Basically libssl 1.1.1 (in whatever 1.1.1 version - my guess is 1.1.1~~pre9-1 from the changelog)
> changed the definition of TLS_MAX_VERSION from TLS1_2_VERSION to TLS1_3_VERSION, which will start to
> break all software in buster using that symbol, until libssl1.1 moves to buster.

I'd say that at least for the SSL_CTX_ctrl() symbol the created 
dependency has to be increased.

Raising the severity of both bugs to RC to make the problem more visible,
and to avoid further duplicate bugs.

Since the new OpenSSL won't enter buster anytime soon, the reasonable 
short-term workaround for testing would be an upload to use 
TLS1_2_VERSION instead of TLS_MAX_VERSION in qtbase-opensource-src.

cu
Adrian

-- 

       "Is there not promise of rain?" Ling Tan asked suddenly out
        of the darkness. There had been need of rain for many days.
       "Only a promise," Lao Er said.
                                       Pearl S. Buck - Dragon Seed

[toc] | [prev] | [next] | [standalone]

#917600 — Bug#908567: [Pkg-openssl-devel] Bug#908567: libssl 1.1.1 TLS_MAX_VERSION ABI breakage

On Tue, Sep 11, 2018 at 02:28:02PM +0200, Jonas Smedegaard wrote:
> Jan-Marek Glogowski wrote:
> > Qt5 is just the first breaking package - I have no idea, how many 
> > packages use TLS_MAX_VERSION in their code.
> 
> According to https://codesearch.debian.net/search?q=TLS_MAX_VERSION the 
> following packages mention TLS_MAX_VERSION in source code:
> 
>  * fetchmail

Should still work

>  * musescore

Has a copy of the header only

>  * qtbase-opensource-src
>  * shim

Has a copy of the header only

>  * ncrack

Has a copy of the header only

>  * globus-gssapi-gsi

Should still work, only in comment, they don't want TLS 1.3


It really looks like qtbase-opensource-src is the only one that
breaks on it.


Kurt

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.bugs.dist

csiph-web