Bug 1267218 - Interleaved Application Data with Handshake data in renegotiated handshakes cause connection abort [rhel-6]
Interleaved Application Data with Handshake data in renegotiated handshakes c...
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: openssl (Show other bugs)
Unspecified Unspecified
high Severity high
: rc
: ---
Assigned To: Tomas Mraz
BaseOS QE Security Team
Depends On:
Blocks: 1172231 1271982 1267220
  Show dependency treegraph
Reported: 2015-09-29 07:28 EDT by Hubert Kario
Modified: 2016-06-09 08:07 EDT (History)
5 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1267220 (view as bug list)
Last Closed: 2016-06-09 08:07:30 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---

Attachments (Terms of Use)

External Trackers
Tracker ID Priority Status Summary Last Updated
Red Hat Knowledge Base (Solution) 1993263 None None None Never

  None (edit)
Description Hubert Kario 2015-09-29 07:28:49 EDT
Description of problem:
When a server receives a client initiated renegotiation and interleaved Application Data with Handshake messages in any of the subsequent handshakes, the connection is aborted with "unexpected record" error on the server side.

This causes applications like PostgreSQL JDBC driver to be incompatible with PostgreSQL.

Version-Release number of selected component (if applicable):

How reproducible:

Steps to Reproduce:
1. openssl req -x509 -newkey rsa -keyout localhost.key -out localhost.crt\
-nodes -batch
2. openssl s_server -key localhost.key -cert\

In another terminal:

3. pip install --pre tlslite-ng
4. git clone https://github.com/tomato42/tlsfuzzer.git

5. cd tlsfuzzer
6. PYTHONPATH=. python scripts/test-openssl-3712.py

Actual results:
139623736735560:error:140940F5:SSL routines:SSL3_READ_BYTES:unexpected record:s3_pkt.c:1421:

Expected results:
Test pass

Additional info:
Comment 13 Tomas Mraz 2016-06-09 08:07:30 EDT
Upstream rejected any changes in this regard and we will not diverge.

Note You need to log in before you can comment on or make changes to this bug.