Bug 1388051 - 3des strength reduction patch malformed
Summary: 3des strength reduction patch malformed
Keywords:
Status: CLOSED DUPLICATE of bug 1276310
Alias: None
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: openssl
Version: 7.2
Hardware: Unspecified
OS: Unspecified
low
low
Target Milestone: rc
: ---
Assignee: Tomas Mraz
QA Contact: BaseOS QE Security Team
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2016-10-24 10:14 UTC by Stefan Ring
Modified: 2017-04-03 14:31 UTC (History)
1 user (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Environment:
Last Closed: 2017-04-03 14:31:34 UTC
Target Upstream Version:

Attachments (Terms of Use)
Add an attachment (proposed patch, testcase, etc.)

Description Stefan Ring 2016-10-24 10:14:39 UTC 
Description of problem:

The patch openssl-1.0.1e-3des-strength.patch has a superfluous empty line in line 32 which makes the patch program ignore the following hunk. The patch looks like it would set four numbers to 112, but it only changes three. I found out about this when I tried building the package on el5 because el5's patch program complains about this and does not silently throw the hunk away.

Version-Release number of selected component (if applicable):
1.0.1e-51.el7_2.7

How reproducible:
Looking at ssl/s2_lib.c, around line 250 (block named "DES_192_EDE3_CBC_WITH_MD5")

Steps to Reproduce:
1.
2.
3.

Actual results:
Compiled source code does not match the (presumed) expectations of the patch author

Expected results:
Patch and compiled source code agree


Additional info:
Comment 1 Tomas Mraz 2016-10-24 10:25:36 UTC 
Thank you for the report. Fortunately only the SSLv2 3DES cipher suite is affected which is not used by default anyway as SSLv2 is disabled.
Comment 2 Tomas Mraz 2017-04-03 14:31:34 UTC 

*** This bug has been marked as a duplicate of bug 1276310 ***
Note You need to log in before you can comment on or make changes to this bug.