Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade installers to OpenSSL 1.1.1j #86003

Closed
ned-deily opened this issue Sep 23, 2020 · 20 comments
Closed

Upgrade installers to OpenSSL 1.1.1j #86003

ned-deily opened this issue Sep 23, 2020 · 20 comments
Labels
3.8 only security fixes 3.9 only security fixes 3.10 only security fixes build The build process and cross-build OS-mac OS-windows type-bug An unexpected behavior, bug, or error

Comments

@ned-deily
Copy link
Member

BPO 41837
Nosy @pfmoore, @ronaldoussoren, @tiran, @tjguk, @ned-deily, @ambv, @zware, @zooba, @miss-islington
PRs
  • bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. #24080
  • [3.9] bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. (GH-24080) #24083
  • [3.8] bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. (GH-24080) #24084
  • bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i #24125
  • [3.9] bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i (GH-24125) #24127
  • [3.8] bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i (GH-24125) #24131
  • bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. #24677
  • [3.8] bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. (GH-24677) #24678
  • [3.9] bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. (GH-24677) #24679
    		•
    Superseder
  • bpo-43631: Update to OpenSSL 1.1.1k
    		•

    Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
closed_at = <Date 2021-04-05.19:37:40.365>
created_at = <Date 2020-09-23.00:59:08.865>
labels = ['OS-mac', 'type-bug', '3.8', '3.9', '3.10', 'build', 'OS-windows']
title = 'Upgrade installers to OpenSSL 1.1.1j'
updated_at = <Date 2021-04-05.19:37:40.364>
user = 'https://github.com/ned-deily'

    bugs.python.org fields:

    activity = <Date 2021-04-05.19:37:40.364>
actor = 'ned.deily'
assignee = 'none'
closed = True
closed_date = <Date 2021-04-05.19:37:40.365>
closer = 'ned.deily'
components = ['Build', 'macOS', 'Windows']
creation = <Date 2020-09-23.00:59:08.865>
creator = 'ned.deily'
dependencies = []
files = []
hgrepos = []
issue_num = 41837
keywords = ['patch']
message_count = 20.0
messages = ['377352', '382102', '382149', '382234', '384311', '384315', '384316', '384434', '384442', '384448', '384452', '384590', '384592', '385102', '387353', '387425', '387846', '387848', '387849', '390251']
nosy_count = 10.0
nosy_names = ['paul.moore', 'ronaldoussoren', 'christian.heimes', 'tim.golden', 'ned.deily', 'lukasz.langa', 'zach.ware', 'steve.dower', 'miss-islington', 'squear']
pr_nums = ['24080', '24083', '24084', '24125', '24127', '24131', '24677', '24678', '24679']
priority = None
resolution = 'out of date'
stage = 'resolved'
status = 'closed'
superseder = '43631'
type = 'behavior'
url = 'https://bugs.python.org/issue41837'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']
    @ned-deily
    Copy link
    Member Author

    "22-Sep-2020 OpenSSL 1.1.1h is now available, including bug fixes"

    Christian, any changes need in _ssl or any other reasons we should not upgrade?

    Changes between 1.1.1g and 1.1.1h [22 Sep 2020]

    *) Certificates with explicit curve parameters are now disallowed in
    verification chains if the X509_V_FLAG_X509_STRICT flag is used.
    [Tomas Mraz]

    *) The 'MinProtocol' and 'MaxProtocol' configuration commands now silently
    ignore TLS protocol version bounds when configuring DTLS-based contexts, and
    conversely, silently ignore DTLS protocol version bounds when configuring
    TLS-based contexts. The commands can be repeated to set bounds of both
    types. The same applies with the corresponding "min_protocol" and
    "max_protocol" command-line switches, in case some application uses both TLS
    and DTLS.

     SSL_CTX instances that are created for a fixed protocol version (e.g.
 TLSv1_server_method()) also silently ignore version bounds.  Previously
 attempts to apply bounds to these protocol versions would result in an
 error.  Now only the "version-flexible" SSL_CTX instances are subject to
 limits in configuration files in command-line options.
 [Viktor Dukhovni]

    *) Handshake now fails if Extended Master Secret extension is dropped
    on renegotiation.
    [Tomas Mraz]

    @ned-deily ned-deily added 3.8 only security fixes 3.9 only security fixes 3.10 only security fixes build The build process and cross-build OS-mac OS-windows labels Sep 23, 2020
    @ned-deily
    Copy link
    Member Author

    Christian, ping?

    @tiran
    Copy link
    Member

    tiran commented Nov 30, 2020

    Sorry, I missed the initial ping.

    The changes look unproblematic to me. Our test suite is passing with 1.1.1h, too. Python doesn't set VERIFY_X509_STRICT by default and does not support DTLS.

    Please go ahead.

    @tiran
    Copy link
    Member

    tiran commented Dec 1, 2020

    You may want to hold off until next week:

    https://mta.openssl.org/pipermail/openssl-announce/2020-December/000186.html

    OpenSSL 1.1.i is a security-fix release. The highest severity issue fixed in this release is HIGH.

    @ned-deily
    Copy link
    Member Author

    New changeset 14097a2 by Ned Deily in branch 'master':
    bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. (GH-24080)
    14097a2

    @ned-deily ned-deily changed the title Upgrade installers to OpenSSL 1.1.1h Upgrade installers to OpenSSL 1.1.1i Jan 4, 2021
    @ned-deily ned-deily changed the title Upgrade installers to OpenSSL 1.1.1h Upgrade installers to OpenSSL 1.1.1i Jan 4, 2021
    @ned-deily
    Copy link
    Member Author

    New changeset f24ac45 by Miss Islington (bot) in branch '3.8':
    bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. (GH-24080) (bpo-24084)
    f24ac45

    @ned-deily
    Copy link
    Member Author

    New changeset 76489dd by Miss Islington (bot) in branch '3.9':
    bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. (GH-24080) (GH-24083)
    76489dd

    @zooba
    Copy link
    Member

    zooba commented Jan 5, 2021

    New changeset afb7144 by Steve Dower in branch 'master':
    bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i (GH-24125)
    afb7144

    @zooba
    Copy link
    Member

    zooba commented Jan 5, 2021

    New changeset c833393 by Steve Dower in branch '3.9':
    bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i (GH-24125)
    c833393

    @zooba
    Copy link
    Member

    zooba commented Jan 6, 2021

    New changeset 86b1207 by Steve Dower in branch '3.8':
    bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i (GH-24125)
    86b1207

    @zooba
    Copy link
    Member

    zooba commented Jan 6, 2021

    I believe this is all done now.

    @zooba zooba closed this as completed Jan 6, 2021
    @zooba zooba closed this as completed Jan 6, 2021
    @squear
    Copy link
    Mannequin

    squear mannequin commented Jan 7, 2021

    The fix has only be done for 3.8, 3.9 and 3.10. Are 3.7 and 3.6 are not impacted?

    @tiran
    Copy link
    Member

    tiran commented Jan 7, 2021

    They are impacted. However 3.7.9 and 3.6.8 were the last releases with binaries for Windows and macOS. All subsequent releases are source-only releases. Since we don't release binaries for 3.6 and 3.7 any more, we typically don't update them.

    @tiran
    Copy link
    Member

    tiran commented Jan 15, 2021

    I got bad news. OpenSSL 1.1.1i introduced a regression in cert validation. This affects some cases that involve self-signed certificates. Cert validation fails if a self-signed certificate is used as both a trust anchor (root CA) and EE cert. This may affect Python.

    Would it be possible to rebuild our OpenSSL binaries with patch openssl/openssl#13749 ?

    @tiran tiran reopened this Jan 15, 2021
    @tiran tiran reopened this Jan 15, 2021
    @tiran tiran added type-bug An unexpected behavior, bug, or error labels Jan 15, 2021
    @zooba
    Copy link
    Member

    zooba commented Feb 19, 2021

    Looks like we missed Christian's last message...

    Have OpenSSL made an updated release? If this issue is as bad as the short description above sounds, I expect they would have.

    It's possible to rebuild with the patch, but easier if it's a release.

    (Also, Christian, should this have been a release blocker? We just made fast releases for a security concern...)

    @ned-deily
    Copy link
    Member Author

    1.1.1j was issued earlier this week and, from browsing the source, it appears that this fix is included (it's not mentioned as a major issue) along with other fixes. So I assume we just need to update the installers to use 1.1.1j. The question is then do need to push updated installers for 3.9.x and 3.8.x? Setting to "deferred blocker" pending a decision.

    @christian? @Łukasz?

    @ned-deily ned-deily changed the title Upgrade installers to OpenSSL 1.1.1i Upgrade installers to OpenSSL 1.1.1j Feb 20, 2021
    @ned-deily ned-deily changed the title Upgrade installers to OpenSSL 1.1.1i Upgrade installers to OpenSSL 1.1.1j Feb 20, 2021
    @ned-deily
    Copy link
    Member Author

    New changeset 0242494 by Ned Deily in branch 'master':
    bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. (GH-24677)
    0242494

    @miss-islington
    Copy link
    Contributor

    New changeset e2f6ed8 by Miss Islington (bot) in branch '3.8':
    bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. (GH-24677)
    e2f6ed8

    @miss-islington
    Copy link
    Contributor

    New changeset 982e8ec by Miss Islington (bot) in branch '3.9':
    bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. (GH-24677)
    982e8ec

    @ned-deily
    Copy link
    Member Author

    Now updated to OpenSSL 1.1.1k in bpo-43631

    @ezio-melotti ezio-melotti transferred this issue from another repository Apr 10, 2022
    Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
    Assignees
    No one assigned
    Labels
    3.8 only security fixes 3.9 only security fixes 3.10 only security fixes build The build process and cross-build OS-mac OS-windows type-bug An unexpected behavior, bug, or error
    Projects
    None yet
    Milestone
    No milestone
    Development

    No branches or pull requests
    4 participants
    @tiran @zooba @ned-deily @miss-islington