#907118 error:141a318a:ssl routines:tls_process_ske_dhe:dh key too small

Package:
bip
Source:
bip
Description:
multiuser irc proxy with conversation replay and more
Submitter:
dann frazier
Date:
2021-10-31 00:48:07 UTC
Severity:
important
Tags:
#907118#5
Date:
2018-08-23 21:24:52 UTC
From:
To:
I run bip on a stretch system, and connect to it from a hexchat client on
sid. After a recent upgrade of the client, which pulled in openssl 1.1,
hexchat began failing to connect to my server with the message:

error:141a318a:ssl routines:tls_process_ske_dhe:dh key too small

I found that backporting bip 0.9.0~rc3-1 to jessie worked. I further found
that just cherry-picking the following commit back to bip 0.8.9 seems to be
sufficient:

  39414f8 Handle OpenSSL version 1.1

Assuming this is the correct fix, could we get that incorporated in a
jessie update?

  -dann
#907118#14
Date:
2018-08-24 20:26:15 UTC
From:
To:
Hi,

I would like to reinforce the request for a stable update:

- according to the openssl maintainer, this is a security issue and
  should be fixed in stable

- without such fix, bip on stable will soon be unusable to any client
  using a recent enough openssl
#907118#21
Date:
2018-08-28 12:53:58 UTC
From:
To:
I just tried backporting commit 39414f8 to the bip version in stretch,
and it doesn't really fix the issue. There is probably some other commit
that is needed.
#907118#28
Date:
2018-08-29 17:38:54 UTC
From:
To:
I literally poked that patch into debian/patches{/series}, quilt
applied it and rebuilt, and it started working for me. Maybe there's
something different about our configs?
#907118#33
Date:
2018-09-29 16:53:27 UTC
From:
To:
May I ask what is the problem here is? It looks like DH key is less than
1024bits in size. This is not per-se an openssl problem but "policy"
(which could be changed but I suggest to update the key instead).
If there is anything that needs to be fixed in bip in order to work
(like missing SNI) then I would add a versioned BREAK to #907015 (after
an upload so please let me know).
Otherwise I would unbreak this bug with #907015.

Sebastian
#907118#38
Date:
2018-10-04 13:32:59 UTC
From:
To:
Control: unblock 907015 by -1

I'm not sure. I just tried it again with the same results. My config
file is attached, with just the sensitive parts obscured. It doesn't
seem to have anything related to this.

In the end, I solved my personal problem by building a backport of the
version in testing, and that just works.

The problem is between clients with libssl 1.1.1 and bip from stable.
bip uses keys that are too small, which are rejected by default by those
clients due to the new default policy.

Since this is a problem between openssl on the client and bip on the
server, adding a Breaks: does not really help with anything.

Yes, I don't think it makes sense to clock openssl on this; the version
of bip in testing/unstable is OK.
#907118#45
Date:
2018-10-04 14:33:06 UTC
From:
To:
Strange, that patch seems to slightly change how the hardcoded dh params are loaded, but it doesn't seem to change the size of them or anything.

It seems that more recently commit 6b3844987509517dad6e41391d9142b867266b8b ripped out the hardcoded dh parameters and replaced them with a system for loading them from files, but that seems too intrusive for a stable update.

I am just taking a flyby look at rc bugs, but if this was my package I would propose a patch replacing the hardcoded 1024 bit parameters with hardcoded 4096 bit parameters as a minimally intrusive fix for stable.
#907118#50
Date:
2018-11-20 08:38:05 UTC
From:
To:
Quack,

This problem is solved in unstable and should not prevent this package
from entering testing.

\_o<
#907118#57
Date:
2020-10-18 15:42:34 UTC
From:
To:
   Package Arrival Notification email
Your Package Has Arrived!
 Dear Customer,

Your package has reach our warehouse and you will need to come to our warehouse to get it, check the attactment for details.
 Sales Order Number: Check attacthment
 Arrival Date: 10/18/2020
 Tracking Number(s): Check attacthment
 Carrier: UPS

 *You are receiving advanced ship notifications for orders placed with us.  If you prefer not to receive these shipment notifications, please foward this email to unsubscribe@ups.com
#907118#62
Date:
2020-10-23 12:13:00 UTC
From:
To:
   Package Arrival Notification email
Your Package Has Arrived!
 Dear Customer,

Your package has reach our warehouse and you will need to come to our warehouse to get it, check the attactment for details.
 Sales Order Number: Check attacthment
 Arrival Date: 10/23/2020
 Tracking Number(s): Check attacthment
 Carrier: UPS

 *You are receiving advanced ship notifications for orders placed with us.  If you prefer not to receive these shipment notifications, please foward this email to unsubscribe@ups.com
#907118#67
Date:
2020-10-23 12:13:00 UTC
From:
To:
   Package Arrival Notification email
Your Package Has Arrived!
 Dear Customer,

Your package has reach our warehouse and you will need to come to our warehouse to get it, check the attactment for details.
 Sales Order Number: Check attacthment
 Arrival Date: 10/23/2020
 Tracking Number(s): Check attacthment
 Carrier: UPS

 *You are receiving advanced ship notifications for orders placed with us.  If you prefer not to receive these shipment notifications, please foward this email to unsubscribe@ups.com
#907118#72
Date:
2021-08-01 15:34:55 UTC
From:
To:
I'm Mrs Alice Walton, I have an important
issue to discuss with you,
for details.
Revert to My Private email: alicewalton011@outlook.co.th
#907118#77
Date:
2021-08-01 15:34:55 UTC
From:
To:
I'm Mrs Alice Walton, I have an important
issue to discuss with you,
for details.
Revert to My Private email: alicewalton011@outlook.co.th
#907118#82
Date:
2021-08-24 13:01:31 UTC
From:
To:
Greetings, from The illuminati world elite empire. Bringing the poor, the needy and the talented to limelight of fame, riches, powers and security, get recognized in your business, political race, rise to the top in whatever you do, be protected spiritually and physically! All these you will achieve in a twinkle of an eye when you get initiated to the great Illuminati empire. Once you are initiated to the illuminati empire you will get numerous benefits and reward.
Note: that this email message was created solely for the purpose of our recruitment scheme which will end next month and this offer is for unique ones only, if you are not serious on joining the illuminati empire, then you are advise not to contact us at all. This is because disloyalty is highly not tolerated here in our organization. Do you agree to be a member of the illuminati new world order? If YES!. Then kindly reply us back on our direct recruitment email only at: joinilluminatin@hotmail.com
Please note, Kindly make sure all your response are send directly to the email stated above only at:> joinilluminatin@hotmail.com For more instructions on our membership process.
Note: Some email providers incorrectly place official Illuminati messages in their spam / junk folder or promotion folder. This can divert and exclude our responses to your emails.
The Illuminati.
#907118#87
Date:
2021-08-24 13:01:31 UTC
From:
To:
Greetings, from The illuminati world elite empire. Bringing the poor, the needy and the talented to limelight of fame, riches, powers and security, get recognized in your business, political race, rise to the top in whatever you do, be protected spiritually and physically! All these you will achieve in a twinkle of an eye when you get initiated to the great Illuminati empire. Once you are initiated to the illuminati empire you will get numerous benefits and reward.
Note: that this email message was created solely for the purpose of our recruitment scheme which will end next month and this offer is for unique ones only, if you are not serious on joining the illuminati empire, then you are advise not to contact us at all. This is because disloyalty is highly not tolerated here in our organization. Do you agree to be a member of the illuminati new world order? If YES!. Then kindly reply us back on our direct recruitment email only at: joinilluminatin@hotmail.com
Please note, Kindly make sure all your response are send directly to the email stated above only at:> joinilluminatin@hotmail.com For more instructions on our membership process.
Note: Some email providers incorrectly place official Illuminati messages in their spam / junk folder or promotion folder. This can divert and exclude our responses to your emails.
The Illuminati.
#907118#92
Date:
2021-09-07 05:41:36 UTC
From:
To:
Ek het hierdie sakegeleentheid -voorstel vir u wat ons sal baat; Ek sal ook
daarvan hou dat jy dit sien.

Groete,
Frank William
64 980 4011
#907118#97
Date:
2021-09-07 05:41:36 UTC
From:
To:
Ek het hierdie sakegeleentheid -voorstel vir u wat ons sal baat; Ek sal ook
daarvan hou dat jy dit sien.

Groete,
Frank William
64 980 4011
#907118#102
Date:
2021-10-29 18:16:59 UTC
From:
To:
Dear Customer,
 We attempted to dispatch your item at 3:30pm on 29th Oct, 2021. (Read enclosed file details)
The dispatch attempt failed because nobody was present at the shipping address, so this notification has been automatically sent.

If the parcel is not scheduled for re-dispatch or picked up within 48 hours, it will be returned to the sender.

Label Number: (Read enclosed file details)
Class: Package Services
Service(s): (Read enclosed file details)
Status: e-Notification sent

Read the enclosed file for details.
 DHL Customer Service.
#907118#107
Date:
2021-10-29 18:16:59 UTC
From:
To:
Dear Customer,
 We attempted to dispatch your item at 3:30pm on 29th Oct, 2021. (Read enclosed file details)
The dispatch attempt failed because nobody was present at the shipping address, so this notification has been automatically sent.

If the parcel is not scheduled for re-dispatch or picked up within 48 hours, it will be returned to the sender.

Label Number: (Read enclosed file details)
Class: Package Services
Service(s): (Read enclosed file details)
Status: e-Notification sent

Read the enclosed file for details.
 DHL Customer Service.