[Bug 1822984] Re: revert tls security level back to 1

[Timo Aaltonen]

Hello Dimitri, or anyone else affected,

Accepted openssl into cosmic-proposed. The package will build now and be
available at
https://launchpad.net/ubuntu/+source/openssl/1.1.1-1ubuntu2.2 in a few
hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested and change the tag from
verification-needed-cosmic to verification-done-cosmic. If it does not
fix the bug for you, please add a comment stating that, and change the
tag to verification-failed-cosmic. In either case, without details of
your testing we will not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: openssl (Ubuntu Cosmic)
       Status: In Progress => Fix Committed

** Tags added: verification-needed verification-needed-cosmic

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to openssl in Ubuntu.
https://bugs.launchpad.net/bugs/1822984

Title:
  revert tls security level back to 1

Status in openssl package in Ubuntu:
  Fix Released
Status in openssl source package in Cosmic:
  Fix Committed
Status in openssl source package in Disco:
  Fix Released

Bug description:
  [Impact]
  * increase minimum default tls security level from 0 to 1, as is the default upstream

  [Test Case]

  * generate 80bits TLS certificate and attempt to use it

  * with prior openssl it should work, but with this update it should
  fail

  [Regression Potential]

  * This increases the minimum required certificate/keys sizes and
  algorithms, back to what Bionic GA openssl 1.1.0 shipped as. It also
  now will match upstream default. It is still lower than Debian's
  default that raises it to 2 by default.

  * Cosmic GA shipped with TLS_SECURITY_LEVEL 0, meaning pretty much any
  weak keys were accepted. With this change keys lower than 112 will be
  rejected, which are considered to be too weak to be useful by most CAs
  out there.

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/openssl/+bug/1822984/+subscriptions