{ "schemaVersion": 1, "title": "Signed Net::SSLeay 1.96 MD2 regression: isolated reproduction on the demo", "capturedOn": "2026-11-06", "scope": "Process-isolated library selection on the user-pinned demo. No installed package downgrade, install, lock, service restart, database write, carrier request or call.", "sourceReferences": [ "https://www.vicidial.org/VICIDIALforum/viewtopic.php?t=42491#p155753", "https://www.vicidial.org/VICIDIALforum/viewtopic.php?t=42491#p155762", "https://download.opensuse.org/repositories/devel:/languages:/perl/15.6/x86_64/perl-Net-SSLeay-1.960.0-lp156.1.1.x86_64.rpm" ], "workingInstalledPackage": "perl-Net-SSLeay-1.940.0-lp156.64.4.x86_64", "affectedPackage": "perl-Net-SSLeay-1.960.0-lp156.1.1.x86_64.rpm", "affectedRpmSha256": "8fb5175d149414f10ea040d48f3e8745e15c1ef1659414015b5b7ac49d7133cf", "authenticationOfArtifact": { "rpmSignature": "RSA/SHA256 key b0ca3e51 verified OK against demo installed RPM trust database", "signedRepositoryMetadata": "Valid detached signature; signed primary metadata digest and package SHA256 independently matched.", "signerFingerprint": "E36293D8346F430483C721E2C81E0C59B0CA3E51" }, "commandContext": { "workingDirectory": "/tmp/vicigeek-net-ssleay-20261106.eSj2Jc", "ISOLATED_PERL5LIB": "/tmp/vicigeek-net-ssleay-20261106.eSj2Jc/extracted-affected/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi", "shell": "bash --noprofile --norc -c", "environmentBoundary": "PERL5LIB unset for installed controls, assigned only within each affected command. ISOLATED_PERL5LIB names the privately extracted RPM module path." }, "captures": [ { "id": "installed-module-before", "capturedAt": "2026-11-06T23:21:55.513516+00:00", "command": "perl -e 'use Net::SSLeay; print Net::SSLeay::SSLeay_version(0);'", "exitStatus": 0, "stdout": "OpenSSL 3.1.4 24 Oct 2023", "stderr": "", "stdoutSha256": "da27504a053fe0e26b4c7078811ef82b20c7c5a3159379b00acaa365c3307af4", "rawStderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "displayedStderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "sanitization": "No output substitutions.", "transcript": [ { "command": "perl -e 'use Net::SSLeay; print Net::SSLeay::SSLeay_version(0);'", "output": [ "OpenSSL 3.1.4 24 Oct 2023" ] } ] }, { "id": "installed-tls-before", "capturedAt": "2026-11-06T23:21:55.540323+00:00", "command": "perl ./tls-head-probe.pl", "exitStatus": 0, "stdout": "TLS_PROTOCOL=TLSv1_3\nCERTIFICATE_AND_HOSTNAME=verified\nHTTP_STATUS=401\n", "stderr": "", "stdoutSha256": "607d89ea9ac0b7275a9fa6d7128349277f174731ea15dc385ed8eeac7752e9d0", "rawStderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "displayedStderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "sanitization": "No output substitutions.", "transcript": [ { "command": "perl ./tls-head-probe.pl", "output": [ "TLS_PROTOCOL=TLSv1_3", "CERTIFICATE_AND_HOSTNAME=verified", "HTTP_STATUS=401" ] } ] }, { "id": "isolated-affected-module", "capturedAt": "2026-11-06T23:21:55.650982+00:00", "command": "PERL5LIB=\"$ISOLATED_PERL5LIB\" perl -e 'use Net::SSLeay; print Net::SSLeay::SSLeay_version(0);'", "exitStatus": 2, "stdout": "", "stderr": "Can't load '/tmp/vicigeek-net-ssleay-20261106.eSj2Jc/extracted-affected/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Net/SSLeay/SSLeay.so' for module Net::SSLeay: /tmp/vicigeek-net-ssleay-20261106.eSj2Jc/extracted-affected/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Net/SSLeay/SSLeay.so: undefined symbol: MD2, version OPENSSL_3.0.0 at /usr/lib/perl5/5.26.1/x86_64-linux-thread-multi/DynaLoader.pm line 193.\n at -e line 1.\nCompilation failed in require at -e line 1.\nBEGIN failed--compilation aborted at -e line 1.\n", "stdoutSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "rawStderrSha256": "6b72101dc12e6a29ec5cc0e80ae76871704998fa4e317609dfbc3978c1f2a5db", "displayedStderrSha256": "59053ed34add95abe057a404d53215843a1a2ad4b2c1a313fd29f95c40984389", "sanitization": "Removed only a NUL control character from DynaLoader stderr; all text, paths, status codes and outcomes are unchanged.", "transcript": [ { "command": "PERL5LIB=\"$ISOLATED_PERL5LIB\" perl -e 'use Net::SSLeay; print Net::SSLeay::SSLeay_version(0);'", "output": [ "Can't load '/tmp/vicigeek-net-ssleay-20261106.eSj2Jc/extracted-affected/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Net/SSLeay/SSLeay.so' for module Net::SSLeay: /tmp/vicigeek-net-ssleay-20261106.eSj2Jc/extracted-affected/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Net/SSLeay/SSLeay.so: undefined symbol: MD2, version OPENSSL_3.0.0 at /usr/lib/perl5/5.26.1/x86_64-linux-thread-multi/DynaLoader.pm line 193.", " at -e line 1.", "Compilation failed in require at -e line 1.", "BEGIN failed--compilation aborted at -e line 1." ] } ] }, { "id": "isolated-affected-tls", "capturedAt": "2026-11-06T23:21:55.688863+00:00", "command": "PERL5LIB=\"$ISOLATED_PERL5LIB\" perl ./tls-head-probe.pl", "exitStatus": 2, "stdout": "", "stderr": "Can't load '/tmp/vicigeek-net-ssleay-20261106.eSj2Jc/extracted-affected/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Net/SSLeay/SSLeay.so' for module Net::SSLeay: /tmp/vicigeek-net-ssleay-20261106.eSj2Jc/extracted-affected/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Net/SSLeay/SSLeay.so: undefined symbol: MD2, version OPENSSL_3.0.0 at /usr/lib/perl5/5.26.1/x86_64-linux-thread-multi/DynaLoader.pm line 193.\n at /usr/lib/perl5/vendor_perl/5.26.1/IO/Socket/SSL.pm line 19.\nCompilation failed in require at /usr/lib/perl5/vendor_perl/5.26.1/IO/Socket/SSL.pm line 19.\nBEGIN failed--compilation aborted at /usr/lib/perl5/vendor_perl/5.26.1/IO/Socket/SSL.pm line 19.\nCompilation failed in require at ./tls-head-probe.pl line 3.\nBEGIN failed--compilation aborted at ./tls-head-probe.pl line 3.\n", "stdoutSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "rawStderrSha256": "d07202822da26a84fa691b7624ba7d5d84e8ca246385d450489c47cbe9554989", "displayedStderrSha256": "b778cf64bca1e9e16e68aaa41d077db39764c9ff97ea2715c9975ca37fb82daa", "sanitization": "Removed only a NUL control character from DynaLoader stderr; all text, paths, status codes and outcomes are unchanged.", "transcript": [ { "command": "PERL5LIB=\"$ISOLATED_PERL5LIB\" perl ./tls-head-probe.pl", "output": [ "Can't load '/tmp/vicigeek-net-ssleay-20261106.eSj2Jc/extracted-affected/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Net/SSLeay/SSLeay.so' for module Net::SSLeay: /tmp/vicigeek-net-ssleay-20261106.eSj2Jc/extracted-affected/usr/lib/perl5/vendor_perl/5.26.1/x86_64-linux-thread-multi/auto/Net/SSLeay/SSLeay.so: undefined symbol: MD2, version OPENSSL_3.0.0 at /usr/lib/perl5/5.26.1/x86_64-linux-thread-multi/DynaLoader.pm line 193.", " at /usr/lib/perl5/vendor_perl/5.26.1/IO/Socket/SSL.pm line 19.", "Compilation failed in require at /usr/lib/perl5/vendor_perl/5.26.1/IO/Socket/SSL.pm line 19.", "BEGIN failed--compilation aborted at /usr/lib/perl5/vendor_perl/5.26.1/IO/Socket/SSL.pm line 19.", "Compilation failed in require at ./tls-head-probe.pl line 3.", "BEGIN failed--compilation aborted at ./tls-head-probe.pl line 3." ] } ] }, { "id": "installed-module-after", "capturedAt": "2026-11-06T23:21:55.744853+00:00", "command": "perl -e 'use Net::SSLeay; print Net::SSLeay::SSLeay_version(0);'", "exitStatus": 0, "stdout": "OpenSSL 3.1.4 24 Oct 2023", "stderr": "", "stdoutSha256": "da27504a053fe0e26b4c7078811ef82b20c7c5a3159379b00acaa365c3307af4", "rawStderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "displayedStderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "sanitization": "No output substitutions.", "transcript": [ { "command": "perl -e 'use Net::SSLeay; print Net::SSLeay::SSLeay_version(0);'", "output": [ "OpenSSL 3.1.4 24 Oct 2023" ] } ] }, { "id": "installed-tls-after", "capturedAt": "2026-11-06T23:21:55.767279+00:00", "command": "perl ./tls-head-probe.pl", "exitStatus": 0, "stdout": "TLS_PROTOCOL=TLSv1_3\nCERTIFICATE_AND_HOSTNAME=verified\nHTTP_STATUS=401\n", "stderr": "", "stdoutSha256": "607d89ea9ac0b7275a9fa6d7128349277f174731ea15dc385ed8eeac7752e9d0", "rawStderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "displayedStderrSha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855", "sanitization": "No output substitutions.", "transcript": [ { "command": "perl ./tls-head-probe.pl", "output": [ "TLS_PROTOCOL=TLSv1_3", "CERTIFICATE_AND_HOSTNAME=verified", "HTTP_STATUS=401" ] } ] } ], "tlsProbe": { "file": "tls-head-probe.pl", "sha256": "bdfd804da80458d63eda3acdaf9765d6b4f44e2af2a065ae274cdac80c47639f", "connection": "127.0.0.1:443 on the demo", "verification": "Strict certificate chain and hostname verification with domain SNI; no bypass", "request": "Unauthenticated HEAD /vicidial/admin.php", "observedWorkingResult": "TLSv1_3; certificate and hostname verified; HTTP 401 authentication required", "boundary": "A 401 establishes the unauthenticated HTTP path; it does not establish an authenticated VICIdial operation." }, "binaryEvidence": { "affectedXsUndefinedSymbol": [ "261: 0000000000000000 0 FUNC GLOBAL DEFAULT UND MD2@OPENSSL_3.0.0 (3)" ], "installedXsMd2SymbolCount": 0, "loadedLibcryptoMd2ExportCount": 0 }, "globalIntegrity": { "unchanged": true, "rpmVerifyExitStatus": 0, "installedModuleSha256": "e719fdbb337ed02095b1726916692c70cb27078b96dd23c0d4ecf3d92d71e914", "installedXsSha256": "b6930d9b19a26cd6b24fc754e91c06e80cfc56d8de908794920d64a7acc74db4" }, "limits": [ "The working installed package is lp156.64.4; the reporter named a different working release lp156.61.2.", "No signed working-RPM archive was obtained, and no actual broken-host package rollback or package lock was tested.", "Returning to the installed control after removing a process-only override is a controlled comparison, not a global repair.", "Shared package configuration and services were not changed." ] }