[Pkg-openssl-devel] Bug#789245: Bug#789245: libssl1.0.0:amd64: libssl-1.0.1k-3+deb8u1 breaks stunnel4 STARTTLS connections

[Christian Kujau]

On Fri, 19 Jun 2015, Kurt Roeckx wrote:
> Is the other side also stunnel, or is it directly using the SMTP
> server?

I don't know for sure, but I doubt that the server side is using stunnel. 
It's a corporate email server, some MS Exchange infrastructure, but the 
SMTP server answers to SSH too:

> debug1: Remote protocol version 2.0, remote software
> version OpenSSH_5.9p1 Debian-5ubuntu1.4

So, this would match Ubuntu 12.04 (LTS), they ship with openssl 1.0.1 but 
appear to ship both libssl1.0.0 and libssl0.9.8 - unfortunately I don't 
know their exact setup.

> In any case there is nothing I can (or want to) do in OpenSSL.
> The other side needs to be fixed to use a stronger group.  If the

Understandingly.

> It's the server that decides the which group to use, so it's
> configured at that side.
> 4.40 should already be in oldstable.

Ubuntu 12.04 (if that's really what they're using) ships with 
stunnel-4.42. But again, I really doubt that they're using stunnel. 
>From what I could gather they're using Sendmail 8.13.8 on port 25, which 
almost maps to the sendmail-8.14.4 that Ubuntu 12.04 is shipping with.

> So it at least looks like the other side is running some older
> software.

Yeah. I'll try to get with someone in contact over there...this won't be 
easy...

Thanks,
Christian.