[19.09] openssl: 1.1.1d -> 1.1.1e

[andir]

Motivation for this change

a "Low severity" [0] security issue:

Fixed an overflow bug in the x64_64 Montgomery squaring procedure used
in exponentiation with 512-bit moduli (CVE-2019-1551)

[0] https://www.openssl.org/news/vulnerabilities.html#y2019

Note: Since the flux of changes to 19.09 is very low I think targeting the release branch without going through staging is fine. Let me know if you think otherwise.

Things done

• Tested using sandboxing (nix.useSandbox on NixOS, or option sandbox in nix.conf on non-NixOS linux)
• Built on platform(s)
  • NixOS
  • macOS
  • other Linux distributions
• Tested via one or more NixOS test(s) if existing and applicable for the change (look inside nixos/tests)
• Tested compilation of all pkgs that depend on this change using nix-shell -p nixpkgs-review --run "nixpkgs-review wip"
• Tested execution of all binary files (usually in ./result/bin/)
• Determined the impact on package closure size (by running nix path-info -S before and after)
• Ensured that relevant documentation is up to date
• Fits CONTRIBUTING.md.

[vcunat]

This apparently broke python3Packages.pyopenssl and thus is blocking both channels. Example failure: https://hydra.nixos.org/build/115097885 (I can reproduce it locally)

[vcunat]

I don't know now. The NEWS only contains the CVE-fixing entry.

[KamilaBorowska]

Fixing in #82928. The 1.1.1e changelog contains the following entry:

Properly detect EOF while reading in libssl. Previously if we hit an EOF while reading in libssl then we would report an error back to the application (SSL_ERROR_SYSCALL) but errno would be 0. We now add an error to the stack (which means we instead return SSL_ERROR_SSL) and therefore give a hint as to what went wrong.

Which causes the issue. The changelog for this release is rather long, so I think patching the CVE is safer overall.

[flokli]

So, apparently this was reverted, and just the CVE-fixing patch applied to 19.09 (but probably not to 20.03 and master, and #82793 and #82789 are still open).

I'm fine with just the CVE-fixing patch for 19.09 (maybe for 20.03 as well), but how do we proceed on that? Where's the discussion happening?