Uploaded image for project: 'RHEL'
  1. RHEL
  2. RHEL-76817

Updating OpenSSL can break OpenSSH [rhel-9.0.0.z]

    • openssh-8.7p1-13.el9_0
    • No
    • Moderate
    • ZStream
    • rhel-sst-security-crypto
    • ssg_security
    • 5
    • False
    • Hide

      None

      Show
      None
    • None
    • Red Hat Enterprise Linux
    • None
    • Hide

      AC1) One time manual check that openssl version check in openssh is relaxed and installation of new version does not break OpenSSH

      Show
      AC1) One time manual check that openssl version check in openssh is relaxed and installation of new version does not break OpenSSH
    • Pass
    • None
    • None

      This is a clone of issue RHEL-73353 to use for version rhel-9.0.0.z

      Original description:

      What were you trying to do that didn't work?

      On a RHEL 9.0 to 9.3, updating the OpenSSL package only breaks OpenSSH

      What is the impact of this issue to you?

      Customers who try to update OpenSSL won't be able to reconnect to their machine after a reboot after restarting the OpenSSH service

      Please provide the package NVR for which the bug is seen:

      openssl-3.2.2-6.el9_5.x86_64
      openssh-8.7p1-29.el9_2.x86_64 (same for the packages provided for RHEL 9.0 to 9.3)

      How reproducible is this bug?:

      Steps to reproduce

      1. cat /etc/redhat-release 
        Red Hat Enterprise Linux release 9.2 (Plow)
      1. rpm -q openssl openssh
        openssl-3.0.7-6.el9_2.x86_64
        openssh-8.7p1-29.el9_2.x86_64
      1. dnf update openssl
        [...]
        Upgrading:
         openssl             x86_64 1:3.2.2-6.el9_5 rhel-9-for-x86_64-baseos-rpms 1.4 M
        [...]
      1. systemctl restart sshd
        Job for sshd.service failed because the control process exited with error code.
        See "systemctl status sshd.service" and "journalctl -xeu sshd.service" for details.
      1. journalctl -u sshd.service --no-pager | tail -6
        Jan 09 03:18:03 node-0.testssl3.lab.psi.pnq2.redhat.com systemd[1]: Stopped OpenSSH server daemon.
        Jan 09 03:18:03 node-0.testssl3.lab.psi.pnq2.redhat.com systemd[1]: Starting OpenSSH server daemon...
        Jan 09 03:18:03 node-0.testssl3.lab.psi.pnq2.redhat.com sshd[17266]: OpenSSL version mismatch. Built against 30000070, you have 30200020
        Jan 09 03:18:03 node-0.testssl3.lab.psi.pnq2.redhat.com systemd[1]: sshd.service: Main process exited, code=exited, status=255/EXCEPTION
        Jan 09 03:18:03 node-0.testssl3.lab.psi.pnq2.redhat.com systemd[1]: sshd.service: Failed with result 'exit-code'.
        Jan 09 03:18:03 node-0.testssl3.lab.psi.pnq2.redhat.com systemd[1]: Failed to start OpenSSH server daemon.

        Expected results

      Having a dependency between those two packages to update the openssh package when the openssl one is updated.

      Actual results

      openssh fails to (re)start

              phybl@redhat.com Petr Hybl
              watson-automation Watson Automation
              Dmitry Belyavskiy Dmitry Belyavskiy
              Maurizio Barbaro Maurizio Barbaro
              Votes:
              0 Vote for this issue
              Watchers:
              10 Start watching this issue

                Created:
                Updated:
                Resolved: