Security LibreSSL May 2017: LibreSSL 2.5.4 Stable Release

eva2000 · May 4, 2017

Centmin Mod + LibreSSL 2.5.4

LibreSSL 2.5.4 is now latest stable release https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.4-relnotes.txt:

We have released LibreSSL 2.5.4, which will be arriving in the
LibreSSL directory of your local OpenBSD mirror soon. It includes the following
changes:

* Reverted a previous change that forced consistency between return
value and error code when specifing a certificate verification
callback, since this breaks the documented API. When a user supplied
callback always returns 1, and later code checks the error code to
potentially abort post verification, this will result in incorrect
successul certificate verification.

* Switched Linux getrandom() usage to non-blocking mode, continuing to
use fallback mechanims if unsuccessful. This works around a design
flaw in Linux getrandom(2) where early boot usage in a library makes
it impossible to recover if getrandom(2) is not yet initialized.

* Fixed a bug caused by the return value being set early to signal
successful DTLS cookie validation. This can mask a later failure and
result in a positive return value being returned from
ssl3_get_client_hello(), when it should return a negative value to
propagate the error.

* Fixed a build error on non-x86/x86_64 systems running Solaris.

The LibreSSL project continues improvement of the codebase to reflect modern,
safe programming practices. We welcome feedback and improvements from the
broader community. Thanks to all of the contributors who helped make this
release possible.
Click to expand...

Centmin Mod 123.08stable and 123.09beta01 Github branches corresponding to Centmin Mod 1.2.3-eva2000.08 stable and Centmin Mod 1.2.3-eva2000.09 beta01 have been updated to default to LibreSSL 2.5.4 for new fresh installs. For existing folks, follow below update instructions.

Centmin Mod Nginx Update LibreSSL

For Centmin Mod 1.2.3-eva2000.08 beta03, .08 stable and higher you can update to LibreSSL 2.5.4 via 2 steps.

Step 1. Updating centmin.sh LIBRESSL_VERSION variable to 2.5.4. Best way is to use centmin.sh menu option 23 submenu option 2 for auto updating Centmin Mod code as outlined at centminmod.com/upgrade.html and at https://community.centminmod.com/threads/new-08-beta-menu-option-updating-centmin-mod-via-git.3084/. That will auto update centmin.sh to latest version which already has LIBRESSL_VERSION='2.5.4' set.

Check your updated Centmin Mod centmin.sh to see if LIBRESSL_VERSION='2.5.4' is set. If not set and you do not have centmin.sh menu option 23 submenu option 1 for git environment setup, then you need to manually update and edit in your persistent config file (create it if it doesn't exist) at /etc/centminmod/custom_config.inc and add to it:
Code (Text):
# LibreSSL
LIBRESSL_SWITCH='y'        # if set to 'y' it overrides OpenSSL as the default static compiled option for Nginx server
LIBRESSL_VERSION='2.5.4'   # Use this version of LibreSSL http://www.libressl.org/
Step 2. Then select centmin.sh menu option #4 to upgrade/downgrade Nginx recompile Nginx and specify latest Nginx version i.e. 1.13.0+ or newer.

For example after recompile Nginx version output will show built with LibreSSL 2.5.4

For 123.09 beta01

nginx -V
nginx version: nginx/1.13.0
built by clang 3.4.2 (tags/RELEASE_34/dot2-final)
built with LibreSSL 2.5.4
TLS SNI support enabled
configure arguments: --with-ld-opt='-lrt -ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -mtune=native -mfpmath=sse -DTCP_FASTOPEN=23 -g -O3 -fstack-protector -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-sign-compare -Wno-string-plus-int -Wno-deprecated-declarations -Wno-unused-parameter -Wno-unused-const-variable -Wno-conditional-uninitialized -Wno-mismatched-tags -Wno-sometimes-uninitialized -Wno-parentheses-equality -Wno-tautological-compare -Wno-self-assign -Wno-deprecated-register -Wno-deprecated -Wno-invalid-source-encoding -Wno-pointer-sign -Wno-parentheses -Wno-enum-conversion -Wno-c++11-compat-deprecated-writable-strings -Wno-write-strings -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.0 --add-module=../ngx_cache_purge-2.3 --add-module=../ngx_devel_kit-0.3.0 --add-module=../set-misc-nginx-module-0.31 --add-module=../echo-nginx-module-0.60 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-module=../headers-more-nginx-module-0.32 --with-pcre=../pcre-8.40 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-openssl=../libressl-2.5.4
Click to expand...

LibreSSL 2.5.4

You'll find latest LibreSSL 2.5.4 on official site.

eva2000 · May 6, 2017

hmm seems LibreSSL 2.5.1 to 2.5.3 have security vulnerability - CVE-2017-8301: TLS verification vulnerability in LibreSSL 2.5.1 - 2.5.3. Seems this was fixed in LibreSSL 2.5.4 https://community.centminmod.com/threads/may-2017-libressl-2-5-4-stable-release.11604/#post-49511

For now, Centmin Mod Nginx users can manually switch their Nginx builds from LibreSSL back to using OpenSSL following these steps:

Updating Centmin Mod Nginx For LibreSSL CVE-2017-8301

1. Create or edit your persistent config file at /etc/centminmod/custom_config.inc and add this variable to switch off LibreSSL default usage in Centmin Mod Nginx and switch back to using OpenSSL which defaults to OPENSSL_VERSION defined OpenSSL 1.0.2k right now
Code (Text):
LIBRESSL_SWITCH='n'
2. Run centmin.sh menu option 4, recompile Nginx to use OpenSSL by specifying the Nginx version you want to update to i.e. 1.13.0

nginx -V
nginx version: nginx/1.13.0
built by clang 3.4.2 (tags/RELEASE_34/dot2-final)
built with OpenSSL 1.0.2k 26 Jan 2017
TLS SNI support enabled
configure arguments: --with-ld-opt='-ljemalloc -Wl,-z,relro -Wl,-rpath,/usr/local/lib' --with-cc-opt='-m64 -mtune=native -mfpmath=sse -DTCP_FASTOPEN=23 -g -O3 -fstack-protector -fuse-ld=gold --param=ssp-buffer-size=4 -Wformat -Werror=format-security -Wp,-D_FORTIFY_SOURCE=2 -Wno-sign-compare -Wno-string-plus-int -Wno-deprecated-declarations -Wno-unused-parameter -Wno-unused-const-variable -Wno-conditional-uninitialized -Wno-mismatched-tags -Wno-sometimes-uninitialized -Wno-parentheses-equality -Wno-tautological-compare -Wno-self-assign -Wno-deprecated-register -Wno-deprecated -Wno-invalid-source-encoding -Wno-pointer-sign -Wno-parentheses -Wno-enum-conversion -Wno-c++11-compat-deprecated-writable-strings -Wno-write-strings -gsplit-dwarf' --sbin-path=/usr/local/sbin/nginx --conf-path=/usr/local/nginx/conf/nginx.conf --with-compat --with-http_stub_status_module --with-http_secure_link_module --with-libatomic --with-http_gzip_static_module --with-http_sub_module --with-http_addition_module --with-http_image_filter_module=dynamic --with-http_geoip_module --with-stream_geoip_module --with-stream_realip_module --with-stream_ssl_preread_module --with-threads --with-stream=dynamic --with-stream_ssl_module --with-http_realip_module --add-dynamic-module=../ngx-fancyindex-0.4.0 --add-module=../ngx_cache_purge-2.3 --add-module=../ngx_devel_kit-0.3.0 --add-module=../set-misc-nginx-module-0.31 --add-module=../echo-nginx-module-0.60 --add-module=../redis2-nginx-module-0.14 --add-module=../ngx_http_redis-0.3.7 --add-module=../memc-nginx-module-0.18 --add-module=../srcache-nginx-module-0.31 --add-module=../headers-more-nginx-module-0.32 --with-pcre=../pcre-8.40 --with-pcre-jit --with-zlib=../zlib-1.2.11 --with-http_ssl_module --with-http_v2_module --with-openssl=../openssl-1.0.2k
Click to expand...

CVE-2017-8301 details

Vulnerability Type: Missing TLS Certificate Validation
Affected Product Code Base: LibreSSL - 2.5.1 - 2.5.3
Vendor of Product: OpenBSD
Affected Component: SSL_set_verify, SSL_CTX_set_verify, SSL_get_verify_result

## Summary

LibreSSL 2.5.1 to 2.5.3 lacks TLS certificate verification if
SSL_get_verify_result is relied upon for a later check of a
verification result, in a use case where a user-provided verification
callback returns 1, as demonstrated by acceptance of invalid
certificates by nginx.

## Additional Information

LibreSSL versions from 2.5.1 until 2.5.3 suffer from a lack of TLS certificate
verification if the user-provided callback for verification returns 1.
This bug was introduced in commit ddd98f8ea741a122952185a36c1396c14c2fda74 [1]
(libcrypto/x509/x509_vfy.c, version 1.58) and has not been fixed upstream yet.

If the user verification callback returns 1, LibreSSL will force the
verification result to X509_V_OK resulting in, contrary to the documentation,
any later checks by the API user through SSL_get_verify_result() to be useless,
as it will always return X509_V_OK instead of any earlier error that occurred
in the verification process.
Click to expand...

An example of real-world software affected by this is nginx [3], bypassing
certificate verification entirely and InspIRCd [4], bypassing the option
of requiring trusted clients upon connect (<connect requiressl="trusted">).

This issue was discovered by Jakub Jirutka <jakub () jirutka cz> from Alpine Linux
using the nginx automated test suite [5] and further investigated by
Duncan Overbruck <duncaen () voidlinux eu> from Void Linux and Shiz <hi () shiz me>
from Alpine Linux.

Not fixed upstream yet, verified by vendor here [6].

This issue got assigned CVE-2017-8301 [7].
Click to expand...

#1257 (Some nginx TLS tests started failing with LibreSSL 2.5.3) – nginx

After we updated LibreSSL from 2.4.4. to 2.5.3 in Alpine Linux, we have noticed that some TLS-related tests in nginx (both 1.10.3 and 1.12.0) started failing. Moreover, most of them fail because nginx accepted certificate that should be rejected! That’s pretty bad regression.

We’re not sure if the problem is in LibreSSL, nginx or nginx-tests, so reporting it to both.
Click to expand...

eva2000 · May 6, 2017

Update. Seems LibreSSL 2.5.4 fixed this Some nginx TLS tests started failing with LibreSSL 2.5.3 (but not with 2.4.4) · Issue #307 · libressl-portable/portable · GitHub but their release notes make no mention of this at all as CVE Security issue https://ftp.openbsd.org/pub/OpenBSD/LibreSSL/libressl-2.5.4-relnotes.txt it was passed off as a bug fix

* Reverted a previous change that forced consistency between return
value and error code when specifing a certificate verification
callback, since this breaks the documented API. When a user supplied
callback always returns 1, and later code checks the error code to
potentially abort post verification, this will result in incorrect
successul certificate verification.
Click to expand...

So folks who got forum alert, don't need to switch to OpenSSL if they are on LibreSSL 2.5.4 as instructed in 1st post

2nd post in this thread though highlights how flexible Centmin Mod Nginx is, it can either use LibreSSL or OpenSSL crypto libraries for HTTPS so can switch between them for Nginx HTTPS usage depending on your needs or if urgent security issues or bugs are found as outlined at https://community.centminmod.com/th...bressl-openssl-support-in-123-09beta01.11122/

rdan · Jun 9, 2017

I switch back to LibreSSL for now as it has much wider support for CHACHA20_POLY1305.

nfn · Jun 10, 2017

RoldanLT said: ↑

I switch back to LibreSSL for now as it has much wider support for CHACHA20_POLY1305.
Click to expand...

Hi

Could you share your SSL Ciphers?

Thanks

rdan · Jun 10, 2017

nfn said: ↑

Hi

Could you share your SSL Ciphers?

Thanks
Click to expand...

https://mozilla.github.io/server-si...&openssl=1.0.1g&hsts=yes&profile=intermediate

Log in / Register

Forums

Get the most out of your Centmin Mod LEMP stack

Security LibreSSL May 2017: LibreSSL 2.5.4 Stable Release

eva2000 Administrator Staff Member

Centmin Mod + LibreSSL 2.5.4

Centmin Mod Nginx Update LibreSSL

LibreSSL 2.5.4

eva2000 Administrator Staff Member

Updating Centmin Mod Nginx For LibreSSL CVE-2017-8301

CVE-2017-8301 details

eva2000 Administrator Staff Member

rdan Well-Known Member

nfn New Member

rdan Well-Known Member

.

Log in / Register

Useful Searches

Get the most out of your Centmin Mod LEMP stack

Security LibreSSL May 2017: LibreSSL 2.5.4 Stable Release

eva2000 Administrator Staff Member

Centmin Mod + LibreSSL 2.5.4

Centmin Mod Nginx Update LibreSSL

LibreSSL 2.5.4

eva2000 Administrator Staff Member

Updating Centmin Mod Nginx For LibreSSL CVE-2017-8301

CVE-2017-8301 details

eva2000 Administrator Staff Member

rdan Well-Known Member

nfn New Member

rdan Well-Known Member

.