Package: openssl Version: 1.0.1t-1+deb8u2 Severity: important Dear Maintainer,
since the last openssl update (from 1.0.1k-3+deb8u5 to 1.0.1t-1+deb8u2) in jessie, openssl fails to process our long CRL: odenbach@viridian1:~$ openssl crl -in /var/tmp/network-ca-crl.pem -noout unable to load CRL 140337784870544:error:0D09E09B:asn1 encoding routines:X509_NAME_EX_D2I:too long:x_name.c:203: 140337784870544:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:697:Field=issuer, Type=X509_CRL_INFO 140337784870544:error:0D08303A:asn1 encoding routines:ASN1_TEMPLATE_NOEXP_D2I:nested asn1 error:tasn_dec.c:697:Field=crl, Type=X509_CRL 140337784870544:error:0906700D:PEM routines:PEM_ASN1_read_bio:ASN1 lib:pem_oth.c:83: odenbach@viridian1:~$ ls -l /var/tmp/network-ca-crl.pem -rw-r--r-- 1 root root 2909209 Jun 6 06:26 /var/tmp/network-ca-crl.pem A working version of openssl shows that the CRL contains nearly 100.000 entries: odenbach@viridian1:~$ WORK/testssl.sh/openssl crl -in /var/tmp/network-ca-crl.pem -noout -text | grep Serial | wc -l 98988 Looks like this known bug: https://www.mail-archive.com/[email protected]/msg44242.html -- System Information: Debian Release: 8.5 APT prefers stable-updates APT policy: (500, 'stable-updates'), (500, 'stable') Architecture: amd64 (x86_64) Kernel: Linux 3.16.0-4-amd64 (SMP w/1 CPU core) Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages openssl depends on: ii libc6 2.19-18+deb8u4 ii libssl1.0.0 1.0.1t-1+deb8u2 openssl recommends no packages. Versions of packages openssl suggests: ii ca-certificates 20141019+deb8u1 -- no debconf information
