gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u #105174

gpshead · 2023-05-31T22:15:29Z

This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t.

The Mac/BuildScript/build-installer.py file appears to have already been updated.

Issue: Update OpenSSL used in binary releases per CVE-2023-0464 #103142

This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py file appears to have already been updated.

gpshead · 2023-05-31T22:17:10Z

#105129 does more of this, so anything missing can probably just be moved over into that. @ned-deily

ned-deily · 2023-05-31T22:21:35Z

@gpshead Sorry I didn't ping you earlier. I did not attempt to do the Windows changes. I figured that should be in a separate PR since the versions don't always match up. But feel free to use either PR.

zooba · 2023-05-31T23:34:22Z

I'm doing updated binaries for Windows now. I'll let you know when they're done

zooba · 2023-05-31T23:48:24Z

Binaries are up now. I'll hit rerun

gpshead · 2023-06-01T03:15:52Z

Modules/_ssl_data_300.h

vs https://github.com/python/cpython/pull/105129/files I manually reverted edits that removed definitions from this file as for the purposes of backporting, I don't want names to disappear. some were FIPS related and I'm blindly guessing that those may be special to some vendor openssl builds without digging into the history? regardless there is no harm in keeping names, everything is #ifdef based.

gpshead · 2023-06-01T03:17:01Z

Modules/_ssl_data_31.h

I'm adding this, generated from 3.1.1 but do not intend to backport it beyond 3.12 (and if it causes anyone trouble in 3.12-land, we can just revert it there or re-add whatever is missing).

diff it vs the _300 file, you'll see the things missing that I avoided removing from the _300 one.

gpshead · 2023-06-01T03:50:24Z

many backport labels removed as older backports will be generated from the 3.11 backport PR and successively chained ones as many backport edits will be the same.

miss-islington · 2023-06-01T16:42:21Z

Thanks @gpshead for the PR 🌮🎉.. I'm working now to backport this PR to: 3.11, 3.12.
🐍🍒⛏🤖

miss-islington · 2023-06-01T16:42:39Z

Sorry, @gpshead, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.
cherry_picker ede89af605b1c0442353435ad22195c16274f65d 3.11

…onGH-105174) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). backports of this prior to 3.12 will not include the openssl 3.1 header. (cherry picked from commit ede89af) Co-authored-by: Gregory P. Smith <greg@krypto.org>

bedevere-bot · 2023-06-01T16:42:43Z

GH-105199 is a backport of this pull request to the 3.12 branch.

…105174) (#105199) gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). backports of this prior to 3.12 will not include the openssl 3.1 header. (cherry picked from commit ede89af) Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>

pythonGH-105174) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). backports of this prior to 3.12 will not include the openssl 3.1 header.. (cherry picked from commit ede89af) Co-authored-by: Gregory P. Smith <greg@krypto.org>

bedevere-bot · 2023-06-01T17:41:38Z

GH-105200 is a backport of this pull request to the 3.11 branch.

…105174) (#105200) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af)

…L 1.1.1u (pythonGH-105174) (pythonGH-105200) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af). (cherry picked from commit a5d2b54) Co-authored-by: Gregory P. Smith <greg@krypto.org>

…pythonGH-105174) (python#105200) Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af)

…05174) (GH-105200) (#105205) Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af) Co-authored-by: Ned Deily <nad@python.org>

…105174) (GH-105200) (#105204) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af). (cherry picked from commit a5d2b54) (cherry picked from commit f90d3f6) Co-authored-by: Gregory P. Smith <greg@krypto.org>

…1.1.1u (pythonGH-105174) (pythonGH-105200) (pythonGH-105205) Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af) (cherry picked from commit e15de14) Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Ned Deily <nad@python.org>

…05174) (GH-105200) (GH-105205) (#105370) Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af) (cherry picked from commit e15de14) Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Ned Deily <nad@python.org>

* Post 3.8.16 * [3.8] Update copyright years to 2023. (pythongh-100852) * [3.8] Update copyright years to 2023. (pythongh-100848). (cherry picked from commit 11f9932) Co-authored-by: Benjamin Peterson <benjamin@python.org> * Update additional copyright years to 2023. Co-authored-by: Ned Deily <nad@python.org> * [3.8] Update copyright year in README (pythonGH-100863) (pythonGH-100867) (cherry picked from commit 30a6cc4) Co-authored-by: Ned Deily <nad@python.org> Co-authored-by: HARSHA VARDHAN <75431678+Thunder-007@users.noreply.github.com> * [3.8] Correct CVE-2020-10735 documentation (pythonGH-100306) (python#100698) (cherry picked from commit 1cf3d78) (cherry picked from commit 88fe8d7) Co-authored-by: Jeremy Paige <ucodery@gmail.com> Co-authored-by: Gregory P. Smith <greg@krypto.org> * [3.8] Bump Azure Pipelines to ubuntu-22.04 (pythonGH-101089) (python#101215) (cherry picked from commit c22a55c) Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com> * [3.8] pythongh-100180: Update Windows installer to OpenSSL 1.1.1s (pythonGH-100903) (python#101258) * pythongh-101422: (docs) TarFile default errorlevel argument is 1, not 0 (pythonGH-101424) (cherry picked from commit ea23271) Co-authored-by: Owain Davies <116417456+OTheDev@users.noreply.github.com> * [3.8] pythongh-95778: add doc missing in some places (pythonGH-100627) (python#101630) (cherry picked from commit 4652182) * [3.8] pythongh-101283: Improved fallback logic for subprocess with shell=True on Windows (pythonGH-101286) (python#101710) Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net> Co-authored-by: Steve Dower <steve.dower@microsoft.com> * [3.8] pythongh-101981: Fix Ubuntu SSL tests with OpenSSL (3.1.0-beta1) CI i… (python#102095) [3.8] pythongh-101981: Fix Ubuntu SSL tests with OpenSSL (3.1.0-beta1) CI issue (pythongh-102079) * [3.8] pythonGH-102306 Avoid GHA CI macOS test_posix failure by using the appropriate macOS SDK (pythonGH-102307) [3.8] Avoid GHA CI macOS test_posix failure by using the appropriate macOS SDK. * [3.8] pythongh-101726: Update the OpenSSL version to 1.1.1t (pythonGH-101727) (pythonGH-101752) Fixes CVE-2023-0286 (High) and a couple of Medium security issues. https://www.openssl.org/news/secadv/20230207.txt Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Ned Deily <nad@python.org> * [3.8] pythongh-102627: Replace address pointing toward malicious web page (pythonGH-102630) (pythonGH-102667) (cherry picked from commit 61479d4) Co-authored-by: Blind4Basics <32236948+Blind4Basics@users.noreply.github.com> Co-authored-by: C.A.M. Gerlach <CAM.Gerlach@Gerlach.CAM> Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com> * [3.8] pythongh-101997: Update bundled pip version to 23.0.1 (pythonGH-101998). (python#102244) (cherry picked from commit 89d9ff0) * [3.8] pythongh-102950: Implement PEP 706 – Filter for tarfile.extractall (pythonGH-102953) (python#104548) Backport of c8c3956 * [3.8] pythongh-99889: Fix directory traversal security flaw in uu.decode() (pythonGH-104096) (python#104332) (cherry picked from commit 0aeda29) Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com> * [3.8] pythongh-104049: do not expose on-disk location from SimpleHTTPRequestHandler (pythonGH-104067) (python#104121) Do not expose the local server's on-disk location from `SimpleHTTPRequestHandler` when generating a directory index. (unnecessary information disclosure) (cherry picked from commit c7c3a60) Co-authored-by: Ethan Furman <ethan@stoneleaf.us> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com> * [3.8] pythongh-103935: Use `io.open_code()` when executing code in trace and profile modules (pythonGH-103947) (python#103954) Co-authored-by: Tian Gao <gaogaotiantian@hotmail.com> * [3.8] pythongh-68966: fix versionchanged in docs (pythonGH-105299) * [3.8] Update GitHub CI workflow for macOS. (pythonGH-105302) * [3.8] pythongh-105184: document that marshal functions can fail and need to be checked with PyErr_Occurred (pythonGH-105185) (python#105222) (cherry picked from commit ee26ca1) Co-authored-by: Irit Katriel <1055913+iritkatriel@users.noreply.github.com> * [3.8] pythongh-102153: Start stripping C0 control and space chars in `urlsplit` (pythonGH-102508) (pythonGH-104575) (pythonGH-104592) (python#104593) (python#104895) `urllib.parse.urlsplit` has already been respecting the WHATWG spec a bit pythonGH-25595. This adds more sanitizing to respect the "Remove any leading C0 control or space from input" [rule](https://url.spec.whatwg.org/GH-url-parsing:~:text=Remove%20any%20leading%20and%20trailing%20C0%20control%20or%20space%20from%20input.) in response to [CVE-2023-24329](https://nvd.nist.gov/vuln/detail/CVE-2023-24329). I simplified the docs by eliding the state of the world explanatory paragraph in this security release only backport. (people will see that in the mainline /3/ docs) (cherry picked from commit d7f8a5f) (cherry picked from commit 2f630e1) (cherry picked from commit 610cc0a) (cherry picked from commit f48a96a) Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Co-authored-by: Illia Volochii <illia.volochii@gmail.com> Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org> * [3.8] pythongh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (pythonGH-105174) (pythonGH-105200) (pythonGH-105205) (python#105370) Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af) (cherry picked from commit e15de14) Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Ned Deily <nad@python.org> * Python 3.8.17 * Post 3.8.17 * Updated CI to build 3.8.17 --------- Co-authored-by: Łukasz Langa <lukasz@langa.pl> Co-authored-by: Benjamin Peterson <benjamin@python.org> Co-authored-by: Ned Deily <nad@python.org> Co-authored-by: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com> Co-authored-by: HARSHA VARDHAN <75431678+Thunder-007@users.noreply.github.com> Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Jeremy Paige <ucodery@gmail.com> Co-authored-by: Hugo van Kemenade <hugovk@users.noreply.github.com> Co-authored-by: Steve Dower <steve.dower@python.org> Co-authored-by: Owain Davies <116417456+OTheDev@users.noreply.github.com> Co-authored-by: Éric <earaujo@caravan.coop> Co-authored-by: Oleg Iarygin <oleg@arhadthedev.net> Co-authored-by: Steve Dower <steve.dower@microsoft.com> Co-authored-by: Dong-hee Na <donghee.na@python.org> Co-authored-by: Blind4Basics <32236948+Blind4Basics@users.noreply.github.com> Co-authored-by: C.A.M. Gerlach <CAM.Gerlach@Gerlach.CAM> Co-authored-by: Pradyun Gedam <pradyunsg@gmail.com> Co-authored-by: Petr Viktorin <encukou@gmail.com> Co-authored-by: Sam Carroll <70000253+samcarroll42@users.noreply.github.com> Co-authored-by: Ethan Furman <ethan@stoneleaf.us> Co-authored-by: Jelle Zijlstra <jelle.zijlstra@gmail.com> Co-authored-by: Tian Gao <gaogaotiantian@hotmail.com> Co-authored-by: Irit Katriel <1055913+iritkatriel@users.noreply.github.com> Co-authored-by: stratakis <cstratak@redhat.com> Co-authored-by: Illia Volochii <illia.volochii@gmail.com>

…on#105174) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). backports of this prior to 3.12 will not include the openssl 3.1 header. (cherry picked from commit ede89af)

Upgrade builds to OpenSSL 1.1.1u.

9228d1b

This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py file appears to have already been updated.

gpshead added type-security A security issue needs backport to 3.7 needs backport to 3.9 only security fixes needs backport to 3.10 only security fixes release-blocker needs backport to 3.11 only security fixes needs backport to 3.12 bug and security fixes labels May 31, 2023

gpshead self-assigned this May 31, 2023

bedevere-bot mentioned this pull request May 31, 2023

Update OpenSSL used in binary releases per CVE-2023-0464 #103142

Closed

ned-deily marked this pull request as ready for review May 31, 2023 22:18

ned-deily requested review from a team, ezio-melotti and hugovk as code owners May 31, 2023 22:18

bedevere-bot added the awaiting core review label May 31, 2023

gpshead mentioned this pull request May 31, 2023

gh-103142: Update error codes, multissltests, and CI workflows for OpenSSL 1.1.1u, 3.0.9, and 3.1.1. #105129

Closed

gpshead and others added 4 commits May 31, 2023 19:51

Merge branch 'main' into openssl-1.1.1u

61b08f1

update _ssl_data_111.h from OpenSSL 1.1.1u

288bf6a

Regenerate _ssl_data header for 3.0.9 and 3.1.1.

bfcc647

add 3.1.1 to multissltests

4b60415

gpshead commented Jun 1, 2023

View reviewed changes

gpshead added 2 commits June 1, 2023 03:25

NEWS entry

c2b48cd

special case _ssl_data_31.h in c-analyzer as is done for the others.

00cc1a1

gpshead requested review from Yhg1s and ned-deily June 1, 2023 03:47

gpshead removed needs backport to 3.7 needs backport to 3.9 only security fixes needs backport to 3.10 only security fixes labels Jun 1, 2023

ned-deily approved these changes Jun 1, 2023

View reviewed changes

bedevere-bot added awaiting merge and removed awaiting core review labels Jun 1, 2023

gpshead merged commit ede89af into python:main Jun 1, 2023

bedevere-bot removed the awaiting merge label Jun 1, 2023

gpshead deleted the openssl-1.1.1u branch June 1, 2023 16:42

bedevere-bot removed the needs backport to 3.12 bug and security fixes label Jun 1, 2023

bedevere-bot removed the needs backport to 3.11 only security fixes label Jun 1, 2023

erlend-aasland mentioned this pull request Jun 6, 2023

3.12 backport gh 105236 #105358

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u #105174

gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u #105174

gpshead commented May 31, 2023 •

edited by bedevere-bot

Loading

gpshead commented May 31, 2023

ned-deily commented May 31, 2023

zooba commented May 31, 2023

zooba commented May 31, 2023

gpshead Jun 1, 2023

gpshead Jun 1, 2023

gpshead commented Jun 1, 2023

miss-islington commented Jun 1, 2023

miss-islington commented Jun 1, 2023

bedevere-bot commented Jun 1, 2023

bedevere-bot commented Jun 1, 2023

gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u #105174

gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u #105174

Conversation

gpshead commented May 31, 2023 • edited by bedevere-bot Loading

gpshead commented May 31, 2023

ned-deily commented May 31, 2023

zooba commented May 31, 2023

zooba commented May 31, 2023

gpshead Jun 1, 2023

Choose a reason for hiding this comment

gpshead Jun 1, 2023

Choose a reason for hiding this comment

gpshead commented Jun 1, 2023

miss-islington commented Jun 1, 2023

miss-islington commented Jun 1, 2023

bedevere-bot commented Jun 1, 2023

bedevere-bot commented Jun 1, 2023

gpshead commented May 31, 2023 •

edited by bedevere-bot

Loading