Bug 1916594

Summary:	Regression in `X509_verify_cert` in openssl 1.1.1i
Product:	[Fedora] Fedora	Reporter:	Florence Blanc-Renaud <frenaud>
Component:	openssl	Assignee:	Sahana Prasad <sahana>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	33	CC:	crypto-team, mturk, sahana, tm
Target Milestone:	---	Keywords:	Patch, Triaged
Target Release:	---	Flags:	fedora-admin-xmlrpc: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openssl-1.1.1i-3.fc33	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:
Clones:	1929208 (view as bug list)		Environment:
Last Closed:	2021-03-08 18:58:05 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	1929208

Description Florence Blanc-Renaud 2021-01-15 08:25:51 UTC

Description of problem:
Fedora rawhide, 33 and 32 are now shipping openssl 1.1.1i that contains a regression in X509_verify_cert. The regression causes verification of a self-signed certificate to fail, and that prevents WebUI authentication in FreeIPA (see freeipa issue https://pagure.io/freeipa/issue/8632).

The regression has already been reported upstream as https://github.com/openssl/openssl/issues/13739 and a fix is available upstream (PR https://github.com/openssl/openssl/pull/13749 merged in commit https://github.com/openssl/openssl/commit/76ed0c0ad119569f6e6f6c96b27b76d3b110413b).

FreeIPA now needs the fix in Fedora rawhide, 33 and 32.

Version-Release number of selected component (if applicable):
openssl-1.1.1i-1.fc34 / openssl-1.1.1i-1.fc33 / openssl-1.1.1i-1.fc32 

How reproducible:
Always

Steps to Reproduce:
1. configure a freeipa server CA less with --no-pkinit option
2. login to webui https://host.ipa.test/ipa/ui

Actual results:
the login fails

Expected results:
login should be successful

Comment 1 Sahana Prasad 2021-01-15 18:09:53 UTC

I will update the Fedora builds shortly.