[Pkg-openssl-devel] Bug#333500: marked as done (CAN-2005-2969:
Potential SSL2 fallback)
Debian Bug Tracking System
owner at bugs.debian.org
Wed Oct 12 21:48:18 UTC 2005
Your message dated Wed, 12 Oct 2005 14:32:08 -0700
with message-id <E1EPoCm-0005PT-00 at spohr.debian.org>
and subject line Bug#333500: fixed in openssl 0.9.8-3
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 12 Oct 2005 08:17:38 +0000
>From jmm at inutil.org Wed Oct 12 01:17:38 2005
Return-path: <jmm at inutil.org>
Received: from (vserver151.vserver151.serverflex.de) [193.22.164.111]
by spohr.debian.org with esmtp (Exim 3.36 1 (Debian))
id 1EPbnt-0002TP-00; Wed, 12 Oct 2005 01:17:37 -0700
Received: from wlan-client-279.informatik.uni-bremen.de ([134.102.117.29] helo=localhost.localdomain)
by vserver151.vserver151.serverflex.de with esmtpsa (TLS-1.0:RSA_AES_256_CBC_SHA:32)
(Exim 4.50)
id 1EPbnp-0008K9-JE
for submit at bugs.debian.org; Wed, 12 Oct 2005 10:17:33 +0200
Received: from jmm by localhost.localdomain with local (Exim 4.54)
id 1EPbof-0001XA-Si; Wed, 12 Oct 2005 10:18:25 +0200
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Moritz Muehlenhoff <jmm at inutil.org>
To: Debian Bug Tracking System <submit at bugs.debian.org>
Subject: CAN-2005-2969: Potential SSL2 fallback
X-Mailer: reportbug 3.17
Date: Wed, 12 Oct 2005 10:18:25 +0200
X-Debbugs-Cc: Debian Security Team <team at security.debian.org>
Message-Id: <E1EPbof-0001XA-Si at localhost.localdomain>
X-SA-Exim-Connect-IP: 134.102.117.29
X-SA-Exim-Mail-From: jmm at inutil.org
X-SA-Exim-Scanned: No (on vserver151.vserver151.serverflex.de); SAEximRunCond expanded to false
Delivered-To: submit at bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-11.0 required=4.0 tests=BAYES_00,HAS_PACKAGE,
X_DEBBUGS_CC autolearn=ham version=2.60-bugs.debian.org_2005_01_02
Package: openssl
Version: 0.9.8-2
Severity: important
Tags: security
Yutaka Oiwa found a vulnerability in OpenSSL:
A vulnerability has been found in all previously released versions of
OpenSSL (all versions up to 0.9.7h and 0.9.8a). Versions 0.9.7h and
0.9.8a have been released to address the issue. The vulnerability
potentially affects applications that use the SSL/TLS server
implementation provided by OpenSSL.
Such applications are affected if they use the option
SSL_OP_MSIE_SSLV2_RSA_PADDING. This option is implied by use of
SSL_OP_ALL, which is intended to work around various bugs in
third-party software that might prevent interoperability. The
SSL_OP_MSIE_SSLV2_RSA_PADDING option disables a verification step in
the SSL 2.0 server supposed to prevent active protocol-version
rollback attacks. With this verification step disabled, an attacker
acting as a "man in the middle" can force a client and a server to
negotiate the SSL 2.0 protocol even if these parties both support SSL
3.0 or TLS 1.0. The SSL 2.0 protocol is known to have severe
cryptographic weaknesses and is supported as a fallback only.
Applications using neither SSL_OP_MSIE_SSLV2_RSA_PADDING nor
SSL_OP_ALL are not affected. Also, applications that disable
use of SSL 2.0 are not affected.
Please see http://www.openssl.org/news/secadv_20051011.txt for the
full advisory, which contains patches for 0.9.7 and 0.9.8.
This has been assigned CAN-2005-2969, please mention so in the changelog
when fixing this.
Cheers,
Moritz
-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable')
Architecture: i386 (i686)
Shell: /bin/sh linked to /bin/bash
Kernel: Linux 2.6.14-rc1
Locale: LANG=C, LC_CTYPE=de_DE.ISO-8859-15 at euro (charmap=ISO-8859-15)
Versions of packages openssl depends on:
ii libc6 2.3.5-6 GNU C Library: Shared libraries an
ii libssl0.9.8 0.9.8-2 SSL shared libraries
openssl recommends no packages.
-- no debconf information
---------------------------------------
Received: (at 333500-close) by bugs.debian.org; 12 Oct 2005 21:38:14 +0000
>From katie at spohr.debian.org Wed Oct 12 14:38:14 2005
Return-path: <katie at spohr.debian.org>
Received: from katie by spohr.debian.org with local (Exim 3.36 1 (Debian))
id 1EPoCm-0005PT-00; Wed, 12 Oct 2005 14:32:08 -0700
From: Kurt Roeckx <kurt at roeckx.be>
To: 333500-close at bugs.debian.org
X-Katie: $Revision: 1.56 $
Subject: Bug#333500: fixed in openssl 0.9.8-3
Message-Id: <E1EPoCm-0005PT-00 at spohr.debian.org>
Sender: Archive Administrator <katie at spohr.debian.org>
Date: Wed, 12 Oct 2005 14:32:08 -0700
Delivered-To: 333500-close at bugs.debian.org
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Level:
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
Source: openssl
Source-Version: 0.9.8-3
We believe that the bug you reported is fixed in the latest version of
openssl, which is due to be installed in the Debian FTP archive:
libcrypto0.9.8-udeb_0.9.8-3_i386.udeb
to pool/main/o/openssl/libcrypto0.9.8-udeb_0.9.8-3_i386.udeb
libssl-dev_0.9.8-3_i386.deb
to pool/main/o/openssl/libssl-dev_0.9.8-3_i386.deb
libssl0.9.8-dbg_0.9.8-3_i386.deb
to pool/main/o/openssl/libssl0.9.8-dbg_0.9.8-3_i386.deb
libssl0.9.8_0.9.8-3_i386.deb
to pool/main/o/openssl/libssl0.9.8_0.9.8-3_i386.deb
openssl_0.9.8-3.diff.gz
to pool/main/o/openssl/openssl_0.9.8-3.diff.gz
openssl_0.9.8-3.dsc
to pool/main/o/openssl/openssl_0.9.8-3.dsc
openssl_0.9.8-3_i386.deb
to pool/main/o/openssl/openssl_0.9.8-3_i386.deb
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to 333500 at bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Kurt Roeckx <kurt at roeckx.be> (supplier of updated openssl package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster at debian.org)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Wed, 12 Oct 2005 22:38:58 +0200
Source: openssl
Binary: libssl-dev openssl libssl0.9.8-dbg libcrypto0.9.8-udeb libssl0.9.8
Architecture: source i386
Version: 0.9.8-3
Distribution: unstable
Urgency: low
Maintainer: Debian OpenSSL Team <pkg-openssl-devel at lists.alioth.debian.org>
Changed-By: Kurt Roeckx <kurt at roeckx.be>
Description:
libcrypto0.9.8-udeb - crypto shared library - udeb (udeb)
libssl-dev - SSL development libraries, header files and documentation
libssl0.9.8 - SSL shared libraries
libssl0.9.8-dbg - Symbol tables for libssl and libcrypt
openssl - Secure Socket Layer (SSL) binary and related cryptographic tools
Closes: 333500
Changes:
openssl (0.9.8-3) unstable; urgency=low
.
* Apply security fix for CAN-2005-2969. (Closes: #333500)
* Change priority of -dbg package to extra.
Files:
81e39fdc08a25e1268e398a04399bfff 785 utils optional openssl_0.9.8-3.dsc
e398e49ad8c9a96462cab374b2e8a840 29143 utils optional openssl_0.9.8-3.diff.gz
a32e8bec17fb9cee5027b5d8454df925 973972 utils optional openssl_0.9.8-3_i386.deb
6c5fff41e733ba539513f535d76f8145 2635326 libs important libssl0.9.8_0.9.8-3_i386.deb
75b839aa53bcab4e0154eb8cb8e135c2 506080 debian-installer optional libcrypto0.9.8-udeb_0.9.8-3_i386.udeb
27d90ecd451b0d55a8b4b6a40ebb308b 2829128 libdevel optional libssl-dev_0.9.8-3_i386.deb
1d7dcd208599c48eec0abd3f0fc1ac48 5124550 libdevel extra libssl0.9.8-dbg_0.9.8-3_i386.deb
Package-Type: udeb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.1 (GNU/Linux)
iD8DBQFDTX2lQdwckHJElwsRAserAJ9xCeOjNp0x05NZENfIhC57p1tWcwCggv0s
UB97TS2xQeGw6JbRl1bJpfw=
=srS8
-----END PGP SIGNATURE-----
More information about the Pkg-openssl-devel
mailing list