New issue
Advanced search Search tips
Note: Color blocks (like or ) mean that a user may not be available. Tooltip shows the reason.

Issue 895476 link

Starred by 25 users

Issue metadata

Status: WontFix
Owner:
Last visit > 30 days ago
Closed: Oct 24
Cc:
Components:
EstimatedDays: ----
NextAction: ----
OS: Windows
Pri: 2
Type: Bug



Sign in to add a comment

ERR_SSL_VERSION_INTERFERNCE with Kaspersky AV

Project Member Reported by svaldez@chromium.org, Oct 15

Issue description

Chrome Version: M69

A recent update (19.0.0.1088(c)) to Kasperky Internet Security (and potentially Kaspersky Anti Virus) causes connections from Chrome to TLS 1.3-enabled websites to break with a ERR_SSL_VERSION_INTERFERENCE error.

We've reached out to Kaspersky to see if they have a timeline for a fix. A temporary remediation appears to be to disable scanning encrypted connections by going to Settings>Advanced>Network>"Do not scan encrypted connections".

A fresh install (uninstall and reinstall) also seems to resolve the problem, though there are some reports that the issue may recur after some time.

 
Cc: swarnasree.mukkala@chromium.org davidben@chromium.org
 Issue 895140  has been merged into this issue.
 Issue 895226  has been merged into this issue.
Cc: susan.boorgula@chromium.org
 Issue 895148  has been merged into this issue.
Cc: svaldez@chromium.org
 Issue 894778  has been merged into this issue.
 Issue 895147  has been merged into this issue.
For david,

My instance of the problem has been resolved!   gmail now loads OK in my
version of Chrome.  Thanks for chasing down Kaspersky!

Best wishes,

Don

[image: Mailtrack]
<https://mailtrack.io?utm_source=gmail&utm_medium=signature&utm_campaign=signaturevirality6&>
Sender
notified by
Mailtrack
<https://mailtrack.io?utm_source=gmail&utm_medium=signature&utm_campaign=signaturevirality6&>
17/10/18,
13:44:38
We've heard back that they are in the process of publishing and rolling out a fix for this issue for users on 19.0.0.1088(c).
Excellent.  It seems to have reached me, as all now working fine again.
Thanks again for sorting it out.

[image: Mailtrack]
<https://mailtrack.io?utm_source=gmail&utm_medium=signature&utm_campaign=signaturevirality6&>
Sender
notified by
Mailtrack
<https://mailtrack.io?utm_source=gmail&utm_medium=signature&utm_campaign=signaturevirality6&>
17/10/18,
15:07:24
Cc: dtapu...@chromium.org
 Issue 896298  has been merged into this issue.
> A recent update (19.0.0.1088(c)) to Kasperky Internet Security
> (and potentially Kaspersky Anti Virus)

I confirm Kaspersky Anti-Virus is affected.

But I doubt it's linked to the version 19.0.0.1088c as this version has been released 3 weeks ago already...
https://support.kaspersky.com/13875#block0
...while the issue is more recent (all the reports are 3 days old max).
Must be linked to smaller updates done everyday.

> My instance of the problem has been resolved!
> gmail now loads OK in my version of Chrome. 

Not the case yet for me.
Labels: -Pri-3 Hotlist-Enterprise OS-Windows Pri-2
Cc: marchuk@google.com
Unfortunately we only have the major version (19.0.0.1088(c)) to reference for the issue. Do you know if there's a way to track down whatever the smaller update versions are?

Kaspersky should have rolled out the fix for part of this issue yesterday, however they've also identified a second issue in their update that might be affecting Chrome/Firefox users, which they are currently working on patching.
 Issue 896430  has been merged into this issue.
 Issue 896914  has been merged into this issue.
Kaspersky published an update that should fix this issue on October 19th.
> Kaspersky published an update that should fix this issue on October 19th.

Confirmed for me. Fixed!

> Unfortunately we only have the major version (19.0.0.1088(c))
> to reference for the issue. Do you know if there's a way to
> track down whatever the smaller update versions are?

Unfortunately, no I don't.
But we're still in 19.0.0.1088c and the issue has been fixed my a minor update so it would be interesting to ask Kaspersky how we can track those minor versions/updates.
In the Detailed reports of the Kaspersky updater there's nothing. It's written "Update of databases and application modules" on absolutely every line, even if there's 7 or 10 updates a day (while I guess the software has not been updated 10 times, it's mostly the database which has been updated).
Now works for me OK.  Thanks for getting to the cause of the problem.
Don
Thank you very much. It works for me now!
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _
_ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _ _

Thank you for co-operating. This email (including any attachments) is
confidential and intended solely for the person or organization to whom it
is addressed. It may contain privileged and confidential information. If
you are not the intended recipient, you should not copy, distribute or take
any action in reliance on it. If you have received this message in error,
please notify immediately by calling or emailing the sender.

With Best Regards,
Parv Joshi
To verify you have the updated patch, you need to check to version of crypto_ssl_1_1.dll.

The following command should return the version in a default installation:

wmic datafile where name="C:\\Program Files (x86)\\Kaspersky Lab\\Kaspersky Internet Security 19.0.0\\crypto_ssl_1_1.dll" get Version /value

If it returns a value later than 1.1.0.8, you have the updated patch.
 Issue 895146  has been merged into this issue.
Cc: abdulsyed@chromium.org vamshi.kommuri@chromium.org viswa.karala@chromium.org
 Issue 893958  has been merged into this issue.
Status: WontFix (was: Assigned)
I think we can probably go ahead and close this, now that Kaspersky has fixed their broken update.
Sure, mine has the correct updated version now and also works well. You
could close this case now. Thank you very much!
My crypto_ssl_1_1.dll version is 1.1.0.8

All good! Scanning encrypted connections with Kaspersky again and using TLS1.3 sites without any issue!

Thanks for all your effort! Issue fixed for me.
 Issue 896894  has been merged into this issue.
> To verify you have the updated patch,
> you need to check to version of crypto_ssl_1_1.dll.

OK for this specific issue, but did by chance Kaspersky provided you with a method to track minor versions?

If we need to report a new issue in the future and want to add our Kaspersky version we may face the same problem in the future. And if you want to inform us that an issue has been fixed from a specific version, you'll always have to describe a method to check and will not be able to just give a minor version number.

Thanks!
Thanks, David.  I will check Kaspersky version. But for the time being all is well again.
Unfortunately it seems that some of the database/code updates just update individual libraries, so other than providing the library version of all the libraries (dll files), there's not a good way to figure out what version of things is breaking. I guess in the future, we can always ask for specific file's (crypto_ssl for TLS/SSL issues, the HTTP library for HTTP issues, etc) versions if bugs are reported that aren't linked to major version.
 Issue 894576  has been merged into this issue.

Sign in to add a comment