Date: Tue, 30 Mar 2021 12:07:41 -0400 From: Karl Denninger <karl@denninger.net> To: Gary Palmer <gpalmer@freebsd.org> Cc: freebsd-stable@freebsd.org Subject: Re: possibly silly question regarding freebsd-update Message-ID: <c16bfed1-52bb-560c-c73f-1edd0c1f876e@denninger.net> In-Reply-To: <YGNLkDpHtIuaO3xp@in-addr.com> References: <YGMpE5uWvRy8Xdql@cloud.zyxst.net> <aad6ecc5-f6b0-92c5-1acb-e9666760e813@madpilot.net> <7e96f815-2955-cfd2-cf6d-16187bc5a233@denninger.net> <YGNLkDpHtIuaO3xp@in-addr.com>
index | next in thread | previous in thread | raw e-mail
[-- Attachment #1 --] On 3/30/2021 12:02, Gary Palmer wrote: > On Tue, Mar 30, 2021 at 11:55:24AM -0400, Karl Denninger wrote: >> On 3/30/2021 11:22, Guido Falsi via freebsd-stable wrote: >>> On 30/03/21 15:35, tech-lists wrote: >>>> Hi, >>>> >>>> Recently there was >>>> https://lists.freebsd.org/pipermail/freebsd-security/2021-March/010380.html >>>> >>>> about openssl. Upgraded to 12.2-p5 with freebsd-update and rebooted. >>>> >>>> What I'm unsure about is the openssl version. >>>> Up-to-date 12.1-p5 instances report OpenSSL 1.1.1h-freebsd? 22 Sep 2020 >>>> >>>> Up-to-date stable/13-n245043-7590d7800c4 reports OpenSSL 1.1.1k-freebsd >>>> 25 Mar 2021 >>>> >>>> shouldn't the 12.2-p5 be reporting openssl 1.1.1k-freebsd as well? >>>> >>> No, as you can see in the commit in the official git [1] while for >>> current and stable the new upstream version of openssl was imported for >>> the release the fix was applied without importing the new release and >>> without changing the reported version of the library. >>> >>> So with 12.2p5 you do get the fix but don't get a new version of the >>> library. >>> >>> >>> [1] https://cgit.freebsd.org/src/commit/?h=releng/12.2&id=af61348d61f51a88b438d41c3c91b56b2b65ed9b >>> >>> >> Excuse me.... >> >> $ uname -v >> FreeBSD 12.2-RELEASE-p4 GENERIC >> $ sudo sh >> # freebsd-update fetch >> Looking up update.FreeBSD.org mirrors... 3 mirrors found. >> Fetching metadata signature for 12.2-RELEASE from update4.freebsd.org... >> done. >> Fetching metadata index... done. >> Inspecting system... done. >> Preparing to download files... done. >> >> No updates needed to update system to 12.2-RELEASE-p5. >> >> I am running 12.2-RELEASE-p4, so says uname -v >> >> IMHO it is an *extraordinarily* bad practice to change a library that in >> fact will result in a revision change while leaving the revision number >> alone. >> >> How do I *know*, without source to go look at, whether or not the fix is >> present on a binary system? >> >> If newvers.sh gets bumped then a build and -p5 release should have resulted >> from that, and in turn a fetch/install (and reboot of course since it's in >> the kernel) should result in uname -v returning "-p5" >> >> Most of my deployed "stuff" is on -STABLE but I do have a handful of >> machines on cloud infrastructure that are binary-only and on which I rely on >> freebsd-update and pkg to keep current with security-related items. > What does "freebsd-version -u" report? The fix was only to a userland > library, so I would not expect the kernel version as reported by uname > to change. > > Regards, > > Gary Ok, that's fair; it DOES show -p5 for the user side. $ freebsd-version -ru 12.2-RELEASE-p4 12.2-RELEASE-p5 So that says my userland is -p5 while the kernel, which did not change (even though if you built from source it would carry the -p5 number) is -p4. I can live with that as it allows me to "see" that indeed the revision is present without having source on the box. I recognize that this is probably a reasonably-infrequent thing but it certainly is one that for people running binary releases is likely quite important given that the issue is in the openssl libraries. It was enough for me to rebuild all the firewall machines the other day since a DOS (which is reasonably possible for one of the flaws) aimed at my VPN server causing the server process to exit would be...... bad. -- Karl Denninger karl@denninger.net <mailto:karl@denninger.net> /The Market Ticker/ /[S/MIME encrypted email preferred]/ [-- Attachment #2 --] 0 *H 010 `He 0 *H 00 H^Ōc!5 H0 *H 01 0 UUS10U Florida10U Niceville10U Cuda Systems LLC10U Cuda Systems CA1!0 U Cuda Systems LLC 2017 CA0 170817164217Z 270815164217Z0{1 0 UUS10U Florida10U Cuda Systems LLC10U Cuda Systems CA1%0#U Cuda Systems LLC 2017 Int CA0"0 *H 0 h-5B>[;olӴ0~͎O9}9Ye*$ g !ukvʶLzN`jL>MD'7U 45CB+kY`bd~b*c3Ny-78ju]9H euέsӬDؽmgwER?&UURj'}9nWD i`XcbGz \gG=u%\Oi13ߝ4 K44pYQr]Ie/r0+eEޝݖ0C15Mݚ@JSZ(zȏ NTa(25DD5.l<g[[Z arQQ%Buȴ~~`IohRbʳڟu2MS8EdFUClCMaѳ !}ș+2k/bųE,n当ꖛ\(8 WV8 d]b yXw ܊:I39 00 U ]^§Q\ӎ0U #0T039N0b01 0 UUS10U Florida10U Niceville10U Cuda Systems LLC10U Cuda Systems CA1!0 U Cuda Systems LLC 2017 CA @Ui0U 0 0U 0 *H :P U!>vJ n io -#ן]Wyu jǑR̀Q nƇ!G ѦF g\ yLx gw=OPycehf[ }ܷ['4ڝ\[p 6\o.B&JF" ZC{;*o*mcCcLY߾` t*S!(` ]DHP5A~/NPp6=mhk밣'doA$86hm5ӚS@ j ެEgl )0JG`%k35PaC?σ ׳HEt}!P㏏%*BxbQwaKG$6 h¦Mve; [o-Iی& I,Tc ߎ#t wPA@l0P+KXBպT zGv;NcI3&J ĬUPNa?/%W6G۟N000 k#Xd\ =0 *H 0{1 0 UUS10U Florida10U Cuda Systems LLC10U Cuda Systems CA1%0#U Cuda Systems LLC 2017 Int CA0 170817212120Z 220816212120Z0W1 0 UUS10U Florida10U Cuda Systems LLC10U karl@denninger.net0"0 *H 0 T[I-ΆϏ dn;Å@שy.us~_ZG%<MYd\gvfnsa1'6Egyjs"C [{~ _K Pn+<*pv#Q+H/7[-vqDV^U>f%GX)H.|l`M(Cr >е͇6#odc"YljҦln8@5SA0&ۖ"OGj?UDWZ5 dDB 7k-)9Izs-JAv J 6L$Ն1SmY.Lqw*SH;EF'DĦH]MOgQQ|Mٙג2Z9y@ y]}6ٽeY9Y2xˆ$T=e CǺǵbn֛{j |@LLt1[Dk5:$= ` M 00<+00.0,+0 http://ocsp.cudasystems.net:88880 U 0 0 `HB0U 0 U %0++03 `HB &$OpenSSL Generated Client Certificate0 U %՞V =;bzQ0U #0]^§Q\ӎϡ01 0 UUS10U Florida10U Niceville10U Cuda Systems LLC10U Cuda Systems CA1!0 U Cuda Systems LLC 2017 CA H^Ōc!5 H0 U 0karl@denninger.net0 *H ۠A0-j%--$% g2#ޡ1^>{K+uGE v1ş7Af&b&O; .;A5* U)ND2bF|\= ]<sˋL!wrw٧> YMÄ3\mWR hSv!_zvl? 3_ xU%\^#O*Gk̍YI_&Fꊛ@&1n } ͬ:{hTP3B.;bU8:Z=^Gw8 !k-@xE@i,+'Iᐚ:f hztX7/(hY` O.1}a`%RW^akǂpCAufgDix UTЩ/7}%=jnVZvcF<M= 2^GKH5魉 _O4ެByʈySkw=5@h.0z> W1000{1 0 UUS10U Florida10U Cuda Systems LLC10U Cuda Systems CA1%0#U Cuda Systems LLC 2017 Int CA k#Xd\ =0 `He E0 *H 1 *H 0 *H 1 210330160742Z0O *H 1B@oT']>8B#zʀgz bQ)S?.%1l _^C4I0W0l *H 1_0]0 `He*0 `He0 *H 0*H 0 *H @0+0 *H (0 +7100{1 0 UUS10U Florida10U Cuda Systems LLC10U Cuda Systems CA1%0#U Cuda Systems LLC 2017 Int CA k#Xd\ =0 *H 10{1 0 UUS10U Florida10U Cuda Systems LLC10U Cuda Systems CA1%0#U Cuda Systems LLC 2017 Int CA k#Xd\ =0 *H G 4&r@SuI-[s) <l,)Bo34k$p2&BUۓ ڥd ?L+O;PAs>9ǀ3%pe̴,#iPw|.)i.@\BVjHv )`. ټՈx]7 jPPz[j'ĢI({͢: bL6ܸ]Q(ϋ@TzGbSPKG ; ]^<d=Y4Y`` ObKſ-p.DEeWvSڮ2/ 0IKE$WA; kr MgгNI&1~\V]8"zjlt[yc! bҥM+5}xmW|~f`_<yӅ$;d/<,R\h~8rPڀAЖj-M ?^e$ l )t#pOm|home | help
Want to link to this message? Use this
URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?c16bfed1-52bb-560c-c73f-1edd0c1f876e>