Bug#728660: libnet-smtp-tls-perl: Uses wrong syntax in SSL_version argument and warning about invalid SSL version

[Jan Wagner]

Hi there,

there is also an ticket at rt.cpan.org[1] and a way how it fixed smtp-cli[2]

Cheers, Jan.
[1] https://rt.cpan.org/Public/Bug/Display.html?id=77401
[2]
https://github.com/mludvig/smtp-cli/commit/5247e094ba8e86a82f5397f9e559ff7959f46e13
-- 
Never write mail to , you have been warned!
-BEGIN GEEK CODE BLOCK-
Version: 3.12
GIT d-- s+: a C+++ UL P+ L+++ E--- W+++ N+++ o++ K++ w--- O M+ V- PS
PE Y++
PGP++ t-- 5 X R tv- b+ DI D+ G++ e++ h r+++ y
--END GEEK CODE BLOCK--



signature.asc
Description: OpenPGP digital signature

Bug#728660: libnet-smtp-tls-perl: Uses wrong syntax in SSL_version argument and warning about invalid SSL version

[Libor Klepáč]

Package: libnet-smtp-tls-perl
Version: 0.12-2
Followup-For: Bug #728660

-BEGIN PGP SIGNED MESSAGE-
Hash: SHA256

Hi,
fix is easy, just remove SSLv3 from SSL_version, it shouldn't be used anyway.
There is no need to remove SSL_verify like suggested in #728248

Libor

- -- System Information:
Debian Release: stretch/sid
  APT prefers experimental
  APT policy: (700, 'experimental'), (700, 'unstable')
Architecture: amd64 (x86_64)
Foreign Architectures: i386

Kernel: Linux 4.5.0-trunk-amd64 (SMP w/4 CPU cores)
Locale: LANG=cs_CZ.UTF-8, LC_CTYPE=cs_CZ.UTF-8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)

Versions of packages libnet-smtp-tls-perl depends on:
ii  libdigest-hmac-perl1.03+dfsg-1
ii  libio-socket-ssl-perl  2.025-1
ii  libnet-ssleay-perl 1.72-1+b2
ii  perl   5.22.1-9

libnet-smtp-tls-perl recommends no packages.

libnet-smtp-tls-perl suggests no packages.

- -- no debconf information

-BEGIN PGP SIGNATURE-
Version: GnuPG v1

iQIcBAEBCAAGBQJXB25IAAoJEPDvjG7Cn0eO4lUP/0DlUJGL06LeqMxIT/QSEfRA
rNA+l3qtXwtq81UD0Uxaoa7xjwkQlPGh6+LS6vNtmlx2WnUodZ3Qyqnl+eY9x+pU
i/uxWlo77YCkHHX5Hu3nxn+RE3Av4rbPqYYk8M8D8w8lRc/j7mjxk4hTsY5qjT9Z
t1BowZJgtEs1lWEAX9SChDMD/ghDpn6Gu5/v4OlGIoMkNxZWGcDBjnruc9keGp+D
BB4h9FDz0DnHUnZbOhUBjdYGJhKNFQNN9DxuTdKrCh7tKU6V59cDOS0Ah9iOoB3W
FRqczkDTsThKCZNC2ZajMgN3DY+EKQkYC44RQmmhjbXoPlnxAm0kHy4V4iCBtXFS
kgm5IrTcbxwPHXTHCPXXdeaoeN9QmegGQ9prVJEDHcmAti922jRTzOfYv5c19IeX
9Gvtm92PhKuMOM+iWiJjvQ346THz26mW2UcauYcxrQMq/6loaNA6XtLAQBHhqtY+
Mywqw2YywIozeEhaxxuivTJdfIGjl3fVUMgxplUGO4HJZJ31jAxI1kGML1yhY2Jl
hSjtaOtmL5udoRx87vsoZm75RXY1bPkaOwHWyb0AM6ne40h5pd6ylLaF9ofeUXB9
CY5c3dSRKvjZasbctRA2r1dLMnIV6YOluh1zr0uvth0rJg+A28rfVUmq/1qWF939
REnzJhwMqGFUdKzPjLOm
=RTat
-END PGP SIGNATURE-
diff -ur a/TLS.pm b/TLS.pm
--- a/TLS.pm	2006-01-17 15:36:34.0 +0100
+++ b/TLS.pm	2016-04-08 10:34:56.0 +0200
@@ -179,7 +179,7 @@
 		croak "Invalid response for STARTTLS: $num $txt\n";
 	}
 	if(not IO::Socket::SSL::socket_to_SSL($me->{sock},
-		SSL_version	=>	"SSLv3 TLSv1")){
+		SSL_version	=>	"TLSv1")){
 			croak "Couldn't start TLS: ".IO::Socket::SSL::errstr."\n";
 	}
 	$me->hello();

Bug#728660: libnet-smtp-tls-perl: Uses wrong syntax in SSL_version argument and warning about invalid SSL version

[Salvatore Bonaccorso]

Package: libnet-smtp-tls-perl
Version: 0.12-1
Severity: important
Tags: upstream wheezy sid
Control: forwarded -1 https://rt.cpan.org/Public/Bug/Display.html?id=85637

Hi 

This is the equivalent bugreport as #728248 (for
libnet-smtp-tls-butmaintained-perl).

With

, [ test.pl ]
| #!/usr/bin/perl
|
| use strict;
| use warnings;
|
| use Net::SMTP::TLS;
| my $mailer = Net::SMTP::TLS-new(
| 'smtp.example.com',
| Hello=  'some.host.name',
| Port =   587,
| User =  'test',
| Password =  's3cr3t',
| );
`

it fails with

$ ./test.pl
invalid SSL_version specified at /usr/share/perl5/IO/Socket/SSL.pm line 418.

p.s.: It might be worth looking what still (build) rdepends on
  libnet-smtp-tls-perl and goint to try to remove the package
  overall for jessie latest. Better alternatives like
  libnet-smtps-perl exists for testing.

Regards,
Salvatore


-- 
To UNSUBSCRIBE, email to debian-bugs-dist-requ...@lists.debian.org
with a subject of unsubscribe. Trouble? Contact listmas...@lists.debian.org