Note: This bug is displayed in read-only format because the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.

Bug 1228892

Summary: openssl update breaks Sendmail TLS to some sites
Product: Red Hat Enterprise Linux 6 Reporter: Paul Sand <sand.paul>
Component: opensslAssignee: Tomas Mraz <tmraz>
Status: CLOSED WONTFIX QA Contact: BaseOS QE Security Team <qe-baseos-security>
Severity: high Docs Contact:
Priority: unspecified    
Version: 6.8CC: tgl
Target Milestone: rc   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2015-06-08 09:26:21 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Paul Sand 2015-06-06 10:42:01 UTC
Description of problem:


Version-Release number of selected component (if applicable):


How reproducible:


Steps to Reproduce:
1.
2.
3.

Actual results:


Expected results:


Additional info:

Comment 1 Paul Sand 2015-06-06 10:50:06 UTC
[Sorry, hit return too soon]

Description of problem:

After upgrading openssl.x86_64 0:1.0.1e-30.el6_6.8 to openssl.x86_64 0:1.0.1e-30.el6_6.9, I noticed outgoing mail failing with the message "TLS handshake failed" to a few sites.



Version-Release number of selected component (if applicable):

openssl.x86_64 0:1.0.1e-30.el6_6.9

How reproducible:


Steps to Reproduce:
1. Upgrade sendmail client system to openssl version above
2. Attempt to send mail to (for example) Dartmouth.edu or umn.edu
3. Watch it fail

Actual results:

Messages fail, remain in queue

Expected results:

The sendmail TLS negotiation should either work or fail; in either case the mail should proceed.

Additional info:

Comment 3 Tomas Mraz 2015-06-08 09:22:57 UTC
That means the servers use seriously insecure DH parameters (shorter than 768 bits).

Can you specify the TLS ciphersuite string in the client? If so, just set DEFAULT:!EDH:!DHE as the ciphersuites and you should be able to connect.

Comment 4 Tomas Mraz 2015-06-08 09:25:55 UTC
Also please report the issue to the affected server sysadmins as they have seriously insecure setup.
See CVE-2015-4000 aka LOGJAM.

Comment 5 Paul Sand 2015-06-08 19:12:12 UTC
Thank you Tomas. I've tested the workaround in Comment 3, and it seems to be safe and effective. Just in case an equally hapless sendmail admin happens across this report, the magic involves appending

    LOCAL_CONFIG
    O CipherList=DEFAULT:!EDH:!DHE

to your sendmail.mc file (where the LOCAL_CONFIG line is only necessary if you don't already have one). Rebuild sendmail.cf, restart sendmail.

I originally thought this only affected client connections. Looking more closely at our logs, I see it also caused server connections to fail.

According to https://weakdh.org/ 14.8% of SMTP servers are vulnerable to LOGJAM. Given that this is (more or less) the sendmail default behavior, I'm surprised it's not more.

Comment 6 Tom Lane 2015-06-23 21:27:36 UTC
See also bug #1235056 which discusses the proper fix for this; hacking the sender's CipherList is of course just a crude workaround.