TLSv1.2 enabling tracker bug

This bug was fixed in the package openssl - 1.0.1e-4ubuntu2

---------------
openssl (1.0.1e-4ubuntu2) trusty; urgency=low

  * Re-enable full TLSv1.2 support (LP: #1257877)
    - debian/patches/tls12_workarounds.patch: disable patch to re-enable
      full TLSv1.2 support. Most problematic sites have been fixed now, and
      we really want proper TLSv1.2 support in an LTS.
 -- Marc Deslauriers <email address hidden> Wed, 04 Dec 2013 12:33:44 -0500

fwiw, I'm seeing issues with offlinemap and alpine seemingly as a result of this bug.

offlineimap now prints errors like:
Establishing connection to mail.brickies.net:993
ERROR: While attempting to sync account 'ssm'
  [Errno 104] Connection reset by peer

alpine gives 'connection reset by peer' error also.

It looks like mail.brickies.net dies when something attempts to connect using TLSv1.2.

Please backport it to Ubuntu 12.04 LTS.

just for my own recollection, to test if this were fixed on the server side:
 openssl s_client -host mail.brickies.net -port 993 -tls1_2

Currently, the above starts with:
CONNECTED(00000003)
write:errno=104

with tls__1, it dies differently, and goes into imap connection with '-tls1'.

> fwiw, I'm seeing issues with offlinemap and alpine seemingly as a result of this bug.
>
> offlineimap now prints errors like:
> Establishing connection to mail.brickies.net:993
> ERROR: While attempting to sync account 'ssm'
> [Errno 104] Connection reset by peer

If offlinemap is offlinemap.com (with description "OffMaps: Offline Maps App for iPhone, iPad & iPod Touch"), then it could be Apple's broken SecureTransport *if* the server is running Apple software. The bug is courtesy of a bad ECDHE-ECDSA implementation. See [1] and [2] for details.

Apple never published an advisory or credited folks with the bug. So its hard to say what versions of their operating system are affected by the broken SecureTransport. Its believed to affect OS X 10.8 through 10.8.4 or so. Its also believed to affect iOS 7 through iOS 7.4 or so. Its also believed that Apple did not backport the fix, so broken versions of their SecureTransport will remain broken.

The OpenSSL folks provided a workaround to the Apple ECDHE-ECDSA bug. But there are two issues with it. First, a developer must "opt-in" by setting SSL_OP_SAFARI_ECDHE_ECDSA_BUG on the context (SSL_CTX object). Second, I'm not sure if SSL_OP_SAFARI_ECDHE_ECDSA_BUG is available in the 1.0.1 branch.

[1] http://openssl.6102.n7.nabble.com/openssl-org-3068-PATCH-Safari-broken-ECDHE-ECDSA-workaround-td45432.html
[2] http://openssl.6102.n7.nabble.com/Apple-are-apparently-dicks-td45512.html

Jeffrey, I believe it is OfflineIMAP - http://offlineimap.org/