From: "Russell King (Oracle)" <linux@armlinux.org.uk>
To: linux-arm-kernel@lists.infradead.org
Subject: Re: PSV: Patch system offline due to system upgrade
Date: Wed, 21 Jun 2023 13:27:53 +0100 [thread overview]
Message-ID: <ZJLsya0t8eJGG4BS@shell.armlinux.org.uk> (raw)
In-Reply-To: <ZJLksOHm4CrvNKV9@shell.armlinux.org.uk>
On Wed, Jun 21, 2023 at 12:53:20PM +0100, Russell King (Oracle) wrote:
> All,
>
> Sorry, but the patch system will be offline for a while, thanks to
> upgrading the mail server from Debian Buster to Debian Bookworm; the
> perl scripts can no longer connect to the SQL server with the totally
> unfathomable complaint:
>
> DBI connect('database=armlinux;host=sql.armlinux.org.uk;mysql_ssl=1;mysql_ssl_ca_file=/etc/local/pki/mysql-cacert.pem;mysql_ssl_verify_server_cert=1',...,...) failed: SSL connection error: Enforcing SSL encryption is not supported
>
> It _looks_ from what the error message seems to be saying that the
> perl DBI folk have *disabled* SSL on database connections... seriously?
> In this day and age where encryption is becoming the norm?
>
> If anyone has any clues, please mail me (privately.)
The problem appears to be that Debian Bookworm regresses the supported
TLS version for DBD::mysql (mariadb) from supporting TLS v1.2 and TLS
v1.3 back to the known-to-be-vulnerable TLS v1.1 !
From what I can tell, under Debian Buster, mariadb was linked against
gnutls. Under Debian Bookworm, at least the "mysql" utility is *not*
dynamically linked against any SSL library, and appears to refer
internally to "yassl" which I can only assume is some home-grown and
if it only supports up to TLS v1.1, insecure implementation of SSL!
Way to go, Debian! That's quite a step backwards in this modern age.
--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!
_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
next prev parent reply other threads:[~2023-06-21 12:28 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-06-21 11:53 PSV: Patch system offline due to system upgrade Russell King (Oracle)
2023-06-21 12:27 ` Russell King (Oracle) [this message]
2023-06-21 12:31 ` Russell King (Oracle)
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ZJLsya0t8eJGG4BS@shell.armlinux.org.uk \
--to=linux@armlinux.org.uk \
--cc=linux-arm-kernel@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).