pkg/51987: certbot accessing openssl in python2.7 causes segfault

[htodd%i8u.org@localhost]

>Number:         51987
>Category:       pkg
>Synopsis:       certbot accessing openssl in python2.7 causes segfault
>Confidential:   no
>Severity:       critical
>Priority:       high
>Responsible:    pkg-manager
>State:          open
>Class:          sw-bug
>Submitter-Id:   net
>Arrival-Date:   Mon Feb 20 17:55:00 +0000 2017
>Originator:     Hisashi T Fujinaka <htodd%twofifty.com@localhost>
>Release:        NetBSD 7.1_RC1
>Organization:
none
>Environment:
	
	
System: NetBSD chris.i8u.org 7.1_RC1 NetBSD 7.1_RC1 (CHRIS) #124: Sun Feb 19 09:31:52 PST 2017 htodd%chris.i8u.org@localhost:/usr/obj/amd64/sys/arch/amd64/compile/CHRIS amd64
Architecture: x86_64
Machine: amd64
>Description:
py-certbot from pkgsrc-2016Q4 using python2.7 dumps core when trying to "certbot certonly ...".

The first dozen lines or so of the backtrace are:
#0  0x00007f7ff7e15f90 in ?? ()
#1  0x00007f7ff0f41dd8 in internal_verify () from /usr/pkg/lib/libcrypto.so.1.0.0
#2  0x00007f7ff0f43b1d in X509_verify_cert () from /usr/pkg/lib/libcrypto.so.1.0.0
#3  0x00007f7ff1442671 in ssl_verify_cert_chain () from /usr/pkg/lib/libssl.so.1.0.0
#4  0x00007f7ff141ff9f in ssl3_get_server_certificate () from /usr/pkg/lib/libssl.so.1.0.0
#5  0x00007f7ff1424a21 in ssl3_connect () from /usr/pkg/lib/libssl.so.1.0.0
#6  0x00007f7ff142d924 in ssl23_connect () from /usr/pkg/lib/libssl.so.1.0.0
#7  0x00007f7feee5700c in _cffi_f_SSL_do_handshake ()
   from /usr/pkg/lib/python2.7/site-packages/cryptography/hazmat/bindings/_openssl.so
#8  0x00007f7ff78d2c9b in PyEval_EvalFrameEx () from /usr/pkg/lib/libpython2.7.so.1.0
#9  0x00007f7ff78d2978 in PyEval_EvalFrameEx () from /usr/pkg/lib/libpython2.7.so.1.0
#10 0x00007f7ff78d48e8 in PyEval_EvalCodeEx () from /usr/pkg/lib/libpython2.7.so.1.0
#11 0x00007f7ff78d26bb in PyEval_EvalFrameEx () from /usr/pkg/lib/libpython2.7.so.1.0
#12 0x00007f7ff78d48e8 in PyEval_EvalCodeEx () from /usr/pkg/lib/libpython2.7.so.1.0

	
>How-To-Repeat:
Install py-certbot from pkgsrc-2016Q4 using python2.7 and try to generate a certificate "certbot certonly ...".
	
>Fix:
Not sure. Also not sure if this is related to pr/51490 python (2.7) needs PaX MPROTECT disabled for some programs.
	

>Unformatted: