Bug 1929208

Summary:	Regression in `X509_verify_cert` in openssl 1.1.1i
Product:	[Fedora] Fedora	Reporter:	Florence Blanc-Renaud <frenaud>
Component:	openssl	Assignee:	Sahana Prasad <sahana>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	32	CC:	crypto-team, extras-qa, mturk, sahana, tm
Target Milestone:	---	Keywords:	Patch, Triaged
Target Release:	---	Flags:	fedora-admin-xmlrpc: mirror+
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	openssl-1.1.1i-2.fc32	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	1916594	Environment:
Last Closed:	2021-03-08 18:58:44 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1916594
Bug Blocks:

Description Florence Blanc-Renaud 2021-02-16 13:17:44 UTC

freeipa also needs a backport to Fedora 32 as this version is still supported, and the current version shipped in fc32 is 1:1.1.1i-1.fc32, which contains the issue.
Could you also build the fix for fedora32?

Thanks

+++ This bug was initially created as a clone of Bug #1916594 +++

Description of problem:
Fedora rawhide, 33 and 32 are now shipping openssl 1.1.1i that contains a regression in X509_verify_cert. The regression causes verification of a self-signed certificate to fail, and that prevents WebUI authentication in FreeIPA (see freeipa issue https://pagure.io/freeipa/issue/8632).

The regression has already been reported upstream as https://github.com/openssl/openssl/issues/13739 and a fix is available upstream (PR https://github.com/openssl/openssl/pull/13749 merged in commit https://github.com/openssl/openssl/commit/76ed0c0ad119569f6e6f6c96b27b76d3b110413b).

FreeIPA now needs the fix in Fedora rawhide, 33 and 32.

Version-Release number of selected component (if applicable):
openssl-1.1.1i-1.fc34 / openssl-1.1.1i-1.fc33 / openssl-1.1.1i-1.fc32 

How reproducible:
Always

Steps to Reproduce:
1. configure a freeipa server CA less with --no-pkinit option
2. login to webui https://host.ipa.test/ipa/ui

Actual results:
the login fails

Expected results:
login should be successful

--- Additional comment from Sahana Prasad on 2021-01-15 18:09:53 UTC ---

I will update the Fedora builds shortly.