<story><title>OpenSSL 1.1.1 End of Life</title><url>https://www.openssl.org/blog/blog/2023/09/11/eol-111/</url></story><parent_chain></parent_chain><comment><author>bazzargh</author><text>OpenSSL 3 seems to be largely compatible (it&amp;#x27;s a much easier upgrade than previous big ones) but the part of this that breaks clients is odd.&lt;p&gt;If your peer closes the connection without sending close_notify, you get an unexpected EOF; 1.1.1 ignored this, 3 passes the error to the client, which needs to set SSL_OP_IGNORE_UNEXPECTED_EOF to recover the old behaviour - but this is only safe as long as the client checks for truncation attacks. This peer behaviour seems to be pretty common for &lt;i&gt;google&lt;/i&gt; servers, so if you use google logins or APIs it&amp;#x27;ll trip you up (from doing these upgrades at work, almost all of the errors I saw were talking to google)&lt;p&gt;What&amp;#x27;s odd to me is most of the patches I saw for this were just setting that flag, and not doing anything about truncation attacks? I&amp;#x27;m sure this will bite us all somewhere down the line.&lt;p&gt;Anyway, some notes for admins of old systems who got to this too late:&lt;p&gt;It was noticeable that this patch got backported into ppa&amp;#x27;s that maintain old&amp;#x2F;deprecated versions of some software. eg the ondrej php ppa has this backported to EOL&amp;#x27;d versions of php. But, this is not the case for the python deadsnakes ppa - I didn&amp;#x27;t look at python 3.8, but 3.9 was fixed at source, and it hasn&amp;#x27;t been backported to the (EOL&amp;#x27;d) 3.7 anywhere. You should be off 3.7 anyway, but if you&amp;#x27;re not, it&amp;#x27;s now urgent.&lt;p&gt;Another notable backport is openresty. If you&amp;#x27;re using nginx with lua and oauth, it&amp;#x27;s a popular choice; but lags the latest nginx by a long way. The latest version is 1.21.4.2 which means it&amp;#x27;s based on nginx 1.21; but nginx is on 1.25 and nginx only released with openssl 3 support in 1.22. If you proxy to https servers, this is a concern. However, digging I found the openssl3 support was backported to openresty a few months ago, so the _current_ version does work without falling over.</text></comment>
<story><title>OpenSSL 1.1.1 End of Life</title><url>https://www.openssl.org/blog/blog/2023/09/11/eol-111/</url></story><parent_chain></parent_chain><comment><author>_V_</author><text>This unfortunately already completely broke Gentoo for the moment :-(&lt;p&gt;Maintainers masked openssl-1.1.1 but there is currently a &lt;i&gt;ton&lt;/i&gt; of packages with (sometimes needlessly) hardcoded requirement for old openssl. Including things like Rust etc. This will be painful.</text></comment>