Update OpenSSL binaries for 1.3.1

[SC1040-TS2]

Context
The current OpenSSL library implemented into Mumble (1.0.2k as of 1.2.19) has had an expired long-term support for a few months now. With this in mind, and given the latest OpenSSL version supports TLS 1.3 among other features, it is highly recommended to update to the newer binaries for security purposes for the 1.4.0 Mumble client release.

Describe the feature you have in mind
Update OpenSSL binary packages to 1.1.1e or a later current version of 1.1.1.

Describe alternatives you've considered
If not retention of the current unsupported library or moving to a different TLS library, there may not be any alternatives.

Additional context
https://www.openssl.org/blog/blog/2018/09/11/release111/ was the initial release announcement. I have yet to find the specific release notes for 1.1.1e at this time, but will edit it in later if possible.

[Krzmbrzl]

I assume you are referring to the OpenSSL that is built into the windows application? 'cause to my knowledge we use dynamic libraries on Linux and thus we don't have influence on what version is actually being used.

I assume that we'll update the libraries for the static build as soon as the new build system (cmake) has been integrated.
/cc @davidebeatrici @ZeroAbility

[SC1040-TS2]

Yes, I am, @Krzmbrzl, for my use case is the Windows x64 build. However, a basic Linux end user whom does not use dynamic libraries may also be affected.

Based on prior version release notes found on the old wiki.mumble.info site, 1.2.16, 1.2.17, and 1.2.19 were the last times major releases of OpenSSL binaries were implemented, as evidenced here.

1.2.16(Relevant because some servers and clients are still on it.): https://wiki.mumble.info/wiki/1.2.16
1.2.17(The HopelessDemocracy.com server is still on it.): https://wiki.mumble.info/wiki/1.2.17
1.2.19(Most non-1.3.0 servers and clients still use this version.): https://wiki.mumble.info/wiki/1.2.19

[SC1040-TS2]

Also keep in mind that updating the static binary packages may or will help open the door to resolving https://github.com/mumble-voip/mumble/issues/3918 in the future.

[Krzmbrzl]

What has to be kept in mind though is that we can only use features of OpenSSL that are included in the version that ships with the oldest Ubuntu LTS. Right now this is Ubuntu 16.04 which ships with OpenSSL 1.0.2g (https://packages.ubuntu.com/xenial/openssl).

This doesn't mean that we can't include newer OpenSSL versions in the windows build but in terms of what features we can implement into Mumble, this is the restriction.

[toby63]

@mumble-voip @Krzmbrzl @davidebeatrici
Is also a problem in the linux static server builds:

SSL: OpenSSL version is 'OpenSSL 1.0.2k  26 Jan 2017'
[...]
Murmur 1.3.1 (1.3.1-rc1) running on X11: Debian GNU/Linux bullseye/sid: Booting servers

I don't know if thats possible, but could you at least include "OpenSSL 1.0.2u" into the static builds (asap, for 1.3.1 release) (Linux static server and windows as well)?
See Website:

20-Dec-2019 | OpenSSL 1.0.2u is now available, including security fixes

Also a note for downloaders of a static build would be nice.
Using EOL software depencies is considered a security issue by default.

Edit: Should also have a priority label, at least priority/P1 - Critical.

[toby63]

@Krzmbrzl @mumble-voip @Kissaki @davidebeatrici
You should at least switch to openssl v.1.0.2u (best bad option) and that should already be implemented in Release 1.3.1.
So I recommend a milestone change (1.3.1) and setting the priority (at least P1, maybe even P0-blocker).

For those arguing that it should wait till #3918 is solved, I disagree.
You are providing an openssl version from 2017(!), so you should at least switch all windows users and static server build users on linux to the newest available version (for 1.0.2), which is 1.0.2u (from December 2019) asap.

Update:
Found this Issue #3053, does that mean that mumble can already be compiled with newer openssl (Issue metioned 1.1.0e)?

[davidebeatrici]

Yes, Mumble can already be compiled with OpenSSL 1.1, but doing that for 1.3.1 would require us to update Qt as well, dropping support for Windows XP.

1.4 will, of course, be released with up-to-date dependencies.

[toby63]

@davidebeatrici @mumble-voip @Kissaki @Krzmbrzl

Yes, Mumble can already be compiled with OpenSSL 1.1, but doing that for 1.3.1 would require us to update Qt as well, dropping support for Windows XP.

So you prefer delivering EOL (and by now extremly outdated) openssl software (which is crucial, because encryption is one of the most important parts), to support an OS that is EOL for 6(!) years?
I very much hope you reconsider that.

• And am I understading correctly that mumble could just use openssl v.1.1.1 (on windows builds) right now?
• And why is the static server build for linux not using the newest openssl?
  (and don't give me "support for super old distros" as an explanation, they can use their super outdated packages if they want to)

I want to add two arguments:

1. Windows XP is only used by ~1% of users (according to wikipedia )
2. You put all users who either communicate with users of old openssl versions or use servers that use old openssl versions at potential risk. And don't argue with the "dynamic library"-situation on distros, that is out of your hands, but this is directly in your hands.

[Kissaki]

None of what you want is trivial. We do what we reasonably can and what makes sense. We do not intend to support XP going forward. But we do value stability and not taking in unnecessary risks. The more we change the higher the risk something breaks. There’s good reasons for the split between minor and patch release being conceptually different.

EOL does not necessarily mean there are issues. Obviously it’s a pressing manner. But that does not mean it’s clearly the best choice to upgrade, or that it is simple or practical.