Re: DSA-288 - a question

[Jason Lunz <lunz@falooley.org>]

porridge@debian.org said:
> DSA 288 [0] says:
> 
> ]  You will have to decide whether you want the security update which is
> ]  not thread-safe and recompile all applications that apparently fail
>    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
> ]  after the upgrade, [...]
> 
> Does that mean that installing 0.9.6c-2.woody.3 and then recompiling
> e.g. stunnel against it will make it work fine even though openssl won't
> be thread-safe?

The DSA implies that, but I don't think it's correct.

> If so, can anyone explain how recompiling an application can help?
> (There are no differences in the library interface between
> openssl-0.9.6c-2.woody.2 and openssl-0.9.6c-2.woody.3)

You're right. if a threaded app is broken after an upgrade to -2.woody.3
then recompiling won't help. 

> If not, then what does it refer to, and is there any way to make
> threaded apps work with openssl 0.9.6c-2.woody.3?

You can make a threaded ssl app safe again by using openssl
0.9.6c-2.woody.4. At the end of DSA 288 are some links to
http://master.debian.org/~joey/NMU/, where there's both a patch that
converts the -2.woody.3 source package to .4 and the actual source
package with the patch applied.

So get the .4 sources, or apply the patch to the .3 sources, then
compile your own libssl-dev -woody.4 package. Install that, then
recompile any threaded ssl apps you have.

Jason