OTC VOTE: Revert the commits merged from PR #16027 in 1.1.1

[Nicola Tuveri]

On the other hand, 1.1.1 is not in its last year of support so it is not
limited to security fixes only.

The commits which this vote proposes to revert fixed a bug that produced
invalid output from functions with a clear intent.
This might have security repercussions, as the user might end up signing
something which is unexpectedly invalid.
But even without concrete security vulnerabilities on record, if we
classify invalid output as a bug this should be fixed in 1.1.1.

There are applications that might be broken, because they relied on the
buggy behavior for producing invalid output as intermediate data, but, as
mentioned in #16266, there are ways of producing the required non-x509 data
without abusing functions meant to produce valid x509.

It is unfortunate for existing applications to break upon a patch release,
but given that patch releases for 1.1.1 are meant to fix security defects
and bugs, this is inevitable for any application relying on buggy behavior
(especially as in the case that triggered this discussion, which configures
a clear abuse of the API, while alternative non-abusive ways of achieving
the intended result exist).



Nicola



On Wed, Aug 11, 2021, 11:00 Tomas Mraz <tomas at openssl.org> wrote:

> As this vote is still ongoing I am going to somewhat promote its case.
> I really suspect that many applications albeit somewhat special ones
> will be broken by this change. So although the change can be surely
> viewed as a bug fix it is IMO wrong that it was merged to the 1.1.1
> branch.
>
> Although there might be security implications of exporting an
> incomplete/broken DER encoding, no concrete security issue was
> presented that exists unless this bug is fixed.
>
> On Tue, 2021-08-10 at 11:53 +0100, Matt Caswell wrote:
> > topic: Revert the commits merged from PR #16027 in 1.1.1
> > Comment: Refer to issue #16266 for background
> > Proposed by Tomas Mraz
> > Public: yes
> > opened: 2021-08-10
> > closed: 2021-mm-dd
> > accepted:  yes/no  (for: X, against: Y, abstained: Z, not voted: T)
> >
> >    Dmitry     [+1]
> >    Matt       [+1]
> >    Pauli      [  ]
> >    Tim        [-1]
> >    Richard    [  ]
> >    Shane      [-1]
> >    Tomas      [+1]
> >    Kurt       [  ]
> >    Matthias   [  ]
> >    Nicola     [-1]
>
> --
> Tomáš Mráz
> No matter how far down the wrong road you've gone, turn back.
>                                               Turkish proverb
> [You'll know whether the road is wrong if you carefully listen to your
> conscience.]
>
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://mta.openssl.org/pipermail/openssl-project/attachments/20210811/224f54bf/attachment-0001.html>