Bug#765639: affecting more and more people

["Adam D. Barratt" <adam@adam-barratt.org.uk>]

On Mon, 2016-02-15 at 19:46 +0100, Christian Beer wrote:
> Hi,
> 
> there are more people reporting that they are directly affected by a bug
> in the Debian Jessie openssl package where it doesn't check an
> alternative certificate chain (which is fixed in the latest upstream 1.0.1).
[...]
> Right now the combination of openssl and ca-certificates in Debian
> Jessie is not working for a lot of websites (that they themselves can't
> fix). I understand the hesitation to upgrade openssl but I would like to
> return to a working Jessie rather than use an obviously broken one.

If it's that broken, then it should be fixed anyway, regardless of any
decision of whether or not to accept full upstream releases in to
Jessie.

Regards,

Adam