-
Bug
-
Resolution: Not a Bug
-
Blocker
-
None
-
CentOS Stream 9
-
None
-
None
-
None
-
rhel-sst-security-crypto
-
ssg_security
-
None
-
None
-
None
-
None
-
None
-
Unspecified
-
None
What were you trying to do that didn't work?
After OpenSSL is updated, ssh command doesn't work. This issue occurs both on the client side and server side.
Please provide the package NVR for which the bug is seen:
I've checked this issue occured in openssh-8.7p1-43, openssh-8.7p1-44(newest version) More specifically, openssl-3.0.7 built version
How reproducible is this bug?:
Always reproducible
Steps to reproduce
- Prepare an environment with OpenSSL 3.0.7 and OpenSSH built with OpenSSL 3.0.7 installed.
```
$ rpm -q openssl openssh
openssl-3.0.7-24.el9.x86_64
openssh-8.7p1-34.el9.x86_64
``` - Update openssl
```
$ sudo dnf update openssl
Last metadata expiration check: 4:42:12 ago on Tue 26 Nov 2024 02:13:05 AM JST.
Dependencies resolved.
======================================================================================================
Package Architecture Version Repository Size
======================================================================================================
Upgrading:
openssl x86_64 1:3.2.2-6.el9 baseos 1.4 M
openssl-libs x86_64 1:3.2.2-6.el9 baseos 2.4 M
Transaction Summary
======================================================================================================
Upgrade 2 Packages
(...)
Upgraded:
openssl-1:3.2.2-6.el9.x86_64 openssl-libs-1:3.2.2-6.el9.x86_64
Complete!
```
- Use ssh command
```
$ ssh 192.168.122.18
OpenSSL version mismatch. Built against 30000070, you have 30200020
```
Expected results
Can connect remote machine.
Actual results
Cannot connect remote machine with openssl version mismatch error
Workaround on user
Update openssh (for openssl 3.2.0 built version)
```
$ sudo dnf update openssh
Last metadata expiration check: 4:47:43 ago on Tue 26 Nov 2024 02:13:05 AM JST.
Dependencies resolved.
======================================================================================================
Package Architecture Version Repository Size
======================================================================================================
Upgrading:
openssh x86_64 8.7p1-44.el9 baseos 460 k
openssh-clients x86_64 8.7p1-44.el9 baseos 717 k
openssh-server x86_64 8.7p1-44.el9 baseos 460 k
Transaction Summary
======================================================================================================
Upgrade 3 Packages
(...)
Upgraded:
openssh-8.7p1-44.el9.x86_64 openssh-clients-8.7p1-44.el9.x86_64 openssh-server-8.7p1-44.el9.x86_64
Complete!
```
After update openssh, ssh command success.
Details of this issue
It appeared that openssh-8.7p1-44 was strongly dependent on openssl-3.2.0, but the package dependencies seemed to be incorrectly configured. When openssl is updated to 3.2.0, openssh should also be updated accordingly.
What needs to be noted is that there are no particular issues when openssh is updated while openssl remains at an older version. When updating openssh, it seems that updating openssl is not mandatory.
I could not rewrite spec and build it by myself to meet these conditions. This issue is likely to occur similarly in RockyLinux and AlmaLinux as well, so I would like this to be addressed.