Bug 1044446

Description of problem:

The MyHosting.com insisted repeatedly that the problem was in the API, so I created a new VPS today, everything worked fine when I noticed that the problem started to appear shortly after the system update.

After the openssl updates that changes the security requirements and has broken my server for secure calls.

wget --secure-protocol=tlsv1 get the file but the WGET is just a simple way to illustrate the problem that is happening after the update, access is via a PHP page where the code is:

...LINESLINESLINESLINESLINESLINESLINESLINESLINESLINESLININESLINESLINES...

function get_fcontent( $url, $javascript_loop = 0, $timeout = 5 ) {
    $url = str_replace( "&", "&", urldecode(trim($url)) );
    $cookie = tempnam ("/tmp", "CURLCOOKIE");
    $ch = curl_init();
    curl_setopt( $ch, CURLOPT_USERAGENT, "Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1" );
    curl_setopt( $ch, CURLOPT_URL, $url );
    curl_setopt( $ch, CURLOPT_COOKIEJAR, $cookie );
    curl_setopt( $ch, CURLOPT_FOLLOWLOCATION, true );
    curl_setopt( $ch, CURLOPT_ENCODING, "" );
    curl_setopt( $ch, CURLOPT_RETURNTRANSFER, true );
    curl_setopt( $ch, CURLOPT_AUTOREFERER, true );
    curl_setopt( $ch, CURLOPT_SSL_VERIFYPEER, false ); # required for https urls
    curl_setopt( $ch, CURLOPT_CONNECTTIMEOUT, $timeout );
    curl_setopt( $ch, CURLOPT_TIMEOUT, $timeout );
    curl_setopt( $ch, CURLOPT_MAXREDIRS, 10 );
    $content = curl_exec( $ch );
    $response = curl_getinfo( $ch );
    curl_close ( $ch );
    if ($response['http_code'] == 301 || $response['http_code'] == 302) {
        ini_set("user_agent", "Mozilla/5.0 (Windows; U; Windows NT 5.1; rv:1.7.3) Gecko/20041001 Firefox/0.10.1");
        if ( $headers = get_headers($response['url']) ) {
            foreach( $headers as $value ) {
                if ( substr( strtolower($value), 0, 9 ) == "location:" )
                    return get_url( trim( substr( $value, 9, strlen($value) ) ) );
            }
        }
    }

    if ( ( preg_match("/>[[:space:]]+window\.location\.replace\('(.*)'\)/i", $content, $value) || preg_match("/>[[:space:]]+window\.location\=\"(.*)\"/i", $content, $value) ) && $javascript_loop < 5) {
        return get_url( $value[1], $javascript_loop+1 );
    } else {
        return array( $content, $response );
    }
}

...LINESLINESLINESLINESLINESLINESLINESLINESLINESLINESLININESLINESLINES...


I have not found an option like "--secure-protocol=tlsv1" in PHP, to circumvent the problem.

Yesterday after the downgrade returned to work, as reported above, but the system update installed the update again, blocking access again.

How can I disable the update of this package?
If you can not disable only the packages, as I disable the automatic update to manual? So can I downgrade afterwards.

Version-Release number of selected components:
[~]# uname -mrs
Linux 2.6.32-042stab079.6 x86_64
[~]# cat /proc/version
Linux version 2.6.32-042stab079.6 (root@rh6-build-x64) (gcc version 4.4.6 20120305 (Red Hat 4.4.6-4) (GCC) ) #1 SMP Mon Aug 26 19:47:50 MSK 20
13

named	9.8.2rc1-RedHat-9.8.2-0.17.rc1.el6_4.6	up

openssl-devel-1.0.1e-16.el6_5.x86_64 (BUG DETECTED)
openssl-1.0.1e-16.el6_5.x86_64 (BUG DETECTED)

openssl-1.0.0-27.el6_4.2.x86_64.rpm (WORKING FINE)
openssl-devel-1.0.0-27.el6_4.2.x86_64.rpm (WORKING FINE)

How reproducible:
Below the chat transcript where Tristan diagnosed the fault that caused the stop of my VPS and days searching for the solution.
I was able to provide that openssl is the issue not cPanel (and the openssl updates were CentOS updates for the Operating System rather than those for cPanel control panel). First, I downgraded my CentOS 6.5 machine to openssl-1.0.0-27 that was the prior openssl version:

wget ftp://fr2.rpmfind.net/linux/centos/6.4/updates/x86_64/Packages/openssl-devel-1.0.0-27.el6_4.2.x86_64.rpm
wget ftp://fr2.rpmfind.net/linux/centos/6.4/updates/x86_64/Packages/openssl-1.0.0-27.el6_4.2.x86_64.rpm

rpm -Uvh openssl-1.0.0-27.el6_4.2.x86_64.rpm
rpm -Uvh openssl-devel-1.0.0-27.el6_4.2.x86_64.rpm

Of note, I had wget the rpms for 1.0.0-27 before I removed the existing openssl and openssl-devel 1.0.1e-16 packages, because yum and wget won't work to grab anything after openssl has been removed. As such, after I wget the older openssl, I removed the openssl and openssl-devel 1.0.1e-16 rpms, then I installed the openssl 1.0.0-27 older openssl rpms. Then I ran this command successfully:

-bash-4.1# wget https://api.mercadolibre.com/items/MLB519566844
--2013-12-14 13:45:16--  https://api.mercadolibre.com/items/MLB519566844
Resolving api.mercadolibre.com... 216.33.196.77, 216.33.197.77
Connecting to api.mercadolibre.com|216.33.196.77|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/json]
Saving to: “MLB519566844.1”

    [ <=>                                                                                         ] 2,549       --.-K/s   in 0s

2013-12-14 13:45:16 (17.7 MB/s) - “MLB519566844.1” saved [2549]

After that, I then re-upgraded openssl using this command:

yum update openssl

After it updated to openssl 1.0.1e-16, then the call began failing again:

-bash-4.1# wget https://api.mercadolibre.com/items/MLB519566844
--2013-12-14 13:49:47--  https://api.mercadolibre.com/items/MLB519566844
Resolving api.mercadolibre.com... 216.33.197.77, 216.33.196.77
Connecting to api.mercadolibre.com|216.33.197.77|:443... connected.
Unable to establish SSL connection.

This is entirely an openssl 1.0.1e-16 bug.

Actual results:
-bash-4.1# wget https://api.mercadolibre.com/items/MLB519566844
--2013-12-14 13:49:47--  https://api.mercadolibre.com/items/MLB519566844
Resolving api.mercadolibre.com... 216.33.197.77, 216.33.196.77
Connecting to api.mercadolibre.com|216.33.197.77|:443... connected.
Unable to establish SSL connection.

Expected results:
-bash-4.1# wget https://api.mercadolibre.com/items/MLB519566844
--2013-12-14 13:45:16--  https://api.mercadolibre.com/items/MLB519566844
Resolving api.mercadolibre.com... 216.33.196.77, 216.33.197.77
Connecting to api.mercadolibre.com|216.33.196.77|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: unspecified [application/json]
Saving to: “MLB519566844.1”

    [ <=>                                                                                         ] 2,549       --.-K/s   in 0s

2013-12-14 13:45:16 (17.7 MB/s) - “MLB519566844.1” saved [2549]

Additional info:

I receive help from Tristan J. Wallace
Technical Analyst III, Forums Specialist
He say: In the meantime, you can wget the old openssl versions that I linked to above, uninstall the current openssl version and install the older version. I purposely did not indicate the rpm removal commands for the current openssl, since yum and wget and any other functions requiring openssl will be broken if you remove the existing openssl rpms without ensuring the older rpms are wget onto the server. If this breaks due to doing it improperly, we cannot be held responsible. If you are uncertain how to perform the task without breaking yum functionality, please contact a qualified systems administrator.

Please let me know if the above is unclear on where the issue lies. You can setup a new CentOS 6.5 system without cPanel installed at all and see the same issue occur. This isn't being caused by cPanel but by openssl and a bug within the newest version.

Thank you.