[Pkg-openssl-devel] Bug#826552: openssl: crl processing fails with X509_NAME_EX_D2I:too long

[Christopher Odenbach]

Package: openssl
Version: 1.0.1t-1+deb8u2
Severity: important

Dear Maintainer,

since the last openssl update (from 1.0.1k-3+deb8u5 to 1.0.1t-1+deb8u2)
in jessie, openssl fails to process our long CRL:

odenbach at viridian1:~$ openssl crl -in /var/tmp/network-ca-crl.pem -noout
unable to load CRL
140337784870544:error:0D09E09B:asn1 encoding routines:X509_NAME_EX_D2I:too long:x_name.c:203:
140337784870544:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:697:Field=issuer, Type=X509_CRL_INFO
140337784870544:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:697:Field=crl, Type=X509_CRL
140337784870544:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:pem_oth.c:83:

odenbach at viridian1:~$ ls -l /var/tmp/network-ca-crl.pem
-rw-r--r-- 1 root root 2909209 Jun  6 06:26 /var/tmp/network-ca-crl.pem

A working version of openssl shows that the CRL contains nearly 100.000 entries:

odenbach at viridian1:~$ WORK/testssl.sh/openssl crl -in /var/tmp/network-ca-crl.pem -noout -text | grep Serial | wc -l
98988

Looks like this known bug:

https://www.mail-archive.com/openssl-dev@openssl.org/msg44242.html

-- System Information:
Debian Release: 8.5
  APT prefers stable-updates
  APT policy: (500, 'stable-updates'), (500, 'stable')
Architecture: amd64 (x86_64)

Kernel: Linux 3.16.0-4-amd64 (SMP w/1 CPU core)
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages openssl depends on:
ii  libc6        2.19-18+deb8u4
ii  libssl1.0.0  1.0.1t-1+deb8u2

openssl recommends no packages.

Versions of packages openssl suggests:
ii  ca-certificates  20141019+deb8u1

-- no debconf information