Public bug reported: [ Impact ]
On Ubuntu 26.04, apt 3.2.0 uses OpenSSL both for TLS (methods/http) and for hashing (libapt-pkg). When OpenSSL is configured for FIPS-only operation (FIPS provider + `default_properties = fips=yes`), every HTTPS download fails: W: Failed to fetch https://ports.ubuntu.com/ubuntu-ports/dists/resolute/InRelease OpenSSL error: error:0308010C:digital envelope routines::unsupported Error reading from server - read (5: Input/output error) [IP: ... 443] TLS itself works (openssl s_client and curl succeed with the same config). The failure sequence: 1. After the response headers arrive, Hashes::Hashes() initializes all supported digests, including MD5. 2. EVP_MD_fetch("MD5") fails under fips=yes and leaves 0x0308010C on the thread's OpenSSL error queue. apt tolerates the missing digest but never clears the error. 3. The next non-blocking SSL_read() returns -1 (normally SSL_ERROR_WANT_READ), but SSL_get_error() finds the stale error on the queue and returns SSL_ERROR_SSL. apt treats the transfer as failed. Plain http:// sources are unaffected because no SSL_get_error() call inspects the queue. As a result, apt cannot use HTTPS sources at all on FIPS-configured 26.04 systems, including the Ubuntu archive over HTTPS and third-party HTTPS-only repositories. This is fixed upstream in apt 3.3.2 (Debian #1140227) by: - dfeecf7f "hashes: Fix lingering OpenSSL error" (ERR_set_mark()/ERR_pop_to_mark() around PrivateHashes::Enable()) - d714c12f "hashes: don't crash on an unavailable digest" (guards HexDigest()/GetHashString() against a digest whose init failed; avoids a crash or garbage digest when MD5 is requested explicitly, e.g. apt-cdrom ident) Both cherry-pick cleanly onto 3.2.0 [ How to reproduce ] Build an (unvalidated) OpenSSL FIPS provider from the pristine openssl source in the archive and run apt with it in FIPS-only mode: # in a clean resolute container/VM, as root sed -i 's/^Types: deb$/Types: deb deb-src/' /etc/apt/sources.list.d/ubuntu.sources apt-get update && apt-get install -y openssl ca-certificates dpkg-dev build-essential perl cd /tmp && apt-get source --download-only openssl dpkg-source -x --skip-patches openssl_*.dsc src && cd src ./Configure enable-fips no-docs && make -j"$(nproc)" build_generated && make -j"$(nproc)" providers/fips.so MOD=$(openssl version -m | sed -E 's/.*"(.*)"/\1/'); cp providers/fips.so "$MOD"/ openssl fipsinstall -module "$MOD"/fips.so -out /etc/ssl/fipsmodule.cnf cat > /etc/ssl/fips.cnf <<'EOF' openssl_conf = openssl_init .include /etc/ssl/fipsmodule.cnf [openssl_init] providers = provider_sect alg_section = algorithm_sect [provider_sect] fips = fips_sect base = base_sect [base_sect] activate = 1 [algorithm_sect] default_properties = fips=yes EOF sed -i 's#http://#https://#' /etc/apt/sources.list.d/ubuntu.sources # Lists must be empty: with cached lists the server answers 304, no body # is hashed, and the bug does not trigger. rm -rf /var/lib/apt/lists/* OPENSSL_CONF=/etc/ssl/fips.cnf apt-get update Expected with 3.2.0: "W: Failed to fetch https://... OpenSSL error: error:0308010C ... Error reading from server" for every InRelease. Expected with the fixed package: all indexes fetched, no warnings. Regression check: run `apt-get update` and `apt-get install <pkg>` over both http:// and https:// without OPENSSL_CONF set (non-FIPS default), and confirm the behavior is unchanged. [ Other Info ] - Upstream: apt 3.3.2 (released 2026-07-30), commits dfeecf7f and d714c12f. - Debian: #1140227 (found in 3.0.3, fixed in 3.3.2). - The development series already has apt 3.3.3, which includes the fix. - The upstream 3.2.y branch has no commits since 3.2.0, so this would be an Ubuntu-specific cherry-pick unless upstream cuts 3.2.1. ** Affects: apt (Ubuntu) Importance: Undecided Status: New ** Tags: fips resolute -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/2171346 Title: apt fails all HTTPS fetches when OpenSSL is in FIPS-only mode (stale OpenSSL error from MD5 init) To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/apt/+bug/2171346/+subscriptions -- ubuntu-bugs mailing list [email protected] https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
