Newest RHEL/CentOS openssl update breaks mysql DHE

It's clear that both upstream MySQL and Percona Server are ffected (I've checked 5.6 branches below):

[openxs@chief mysql-server]$ git pull
Already up-to-date.
[openxs@chief mysql-server]$ grep -rn dh512_p *
extra/yassl/src/yassl.cpp:89: static unsigned char dh512_p[] =
extra/yassl/src/yassl.cpp:105: base.dh_->p = BN_bin2bn(dh512_p, sizeof(dh512_p), 0);
vio/viosslfactories.c:23:static unsigned char dh512_p[]=
vio/viosslfactories.c:42: dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
[openxs@chief mysql-server]$ grep -rn dh1024_p *
extra/yassl/testsuite/test.hpp:486: static unsigned char dh1024_p[] =
extra/yassl/testsuite/test.hpp:508: dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), 0);
[openxs@chief mysql-server]$ cd ../percona-server/
[openxs@chief percona-server]$ grep -rn dh512_p *
extra/yassl/src/yassl.cpp:89: static unsigned char dh512_p[] =
extra/yassl/src/yassl.cpp:105: base.dh_->p = BN_bin2bn(dh512_p, sizeof(dh512_p), 0);
vio/viosslfactories.c:23:static unsigned char dh512_p[]=
vio/viosslfactories.c:42: dh->p=BN_bin2bn(dh512_p,sizeof(dh512_p),NULL);
[openxs@chief percona-server]$ grep -rn dh1024_p *
extra/yassl/testsuite/test.hpp:486: static unsigned char dh1024_p[] =
extra/yassl/testsuite/test.hpp:508: dh->p = BN_bin2bn(dh1024_p, sizeof(dh1024_p), 0);
[openxs@chief percona-server]$ git branch
* 5.6

Do you prefer to report upstream bug yourself to get a credit?

Logged upstream as http://bugs.mysql.com/77275

MariaDB bug and fix in 10.0.18:

https://mariadb.atlassian.net/browse/MDEV-7695
https://github.com/MariaDB/server/commit/7e7dd8e

Fix will also appear in MariaDB 5.5.44.

The problem is also present in Ubuntu after installing http://www.ubuntu.com/usn/usn-2639-1/

How can we downgrade OpenSSL when it seems all the packages have been removed from the repo's? :-/

$ sudo apt-get install openssl=1.0.1f-1ubuntu2.12
Reading package lists... Done
Building dependency tree
Reading state information... Done
E: Version '1.0.1f-1ubuntu2.12' for 'openssl' was not found

$ apt-cache showpkg openssl
[...]
Provides:
1.0.1f-1ubuntu2.15 -
1.0.1f-1ubuntu2 -

1.0.1f-1ubuntu2.15 is the version that has broken our databases :-/

percona mysql server also broken on Debian now after DSA 3287-1 went live: https://lists.debian.org/debian-security-announce/2015/msg00182.html

Found the packages in the local cache on all our servers.

Rolled back with...
sudo dpkg -i /var/cache/apt/archives/libssl1.0.0_1.0.1f-1ubuntu2.12_amd64.deb
sudo dpkg -i /var/cache/apt/archives/openssl_1.0.1f-1ubuntu2.12_amd64.deb

https://github.com/percona/percona-server/pull/90
https://github.com/percona/percona-server/pull/91

Thank you for fixing this issue. Any ideas when a new package will be released to the repo's so we can test it?

Packages are now available in our testing repos (https://www.percona.com/doc/percona-server/5.5/installation/apt_repo.html#percona-apt-testing-repository) so you can give them a try.

Are xtradb cluster builds being done by a different team? I don't see an update for that in the testing repo.

@jolan - PXC will be fixed in the next/upcoming release.

@hrvojem Any rough timeframe on when we might see that release?

Percona now uses JIRA for bug reports so this bug report is migrated to: https://jira.percona.com/browse/PS-906