GeezerVison

.. versionadded:: 3.6

.. data:: OP_IGNORE_UNEXPECTED_EOF

Ignore unexpected shutdown of TLS connections.

This option is only available with OpenSSL 3.0.0 and later.

.. versionadded:: 3.7.17.9

.. data:: HAS_ALPN

Whether the OpenSSL library has built-in support for the *Application-Layer

the CVE-2023-27043 fix.)

Notable changes in 3.7.17.4

tarfile

* Fixed CVE-2024-0397 Fix locking in ``cert_store_stats`` and ``get_ca_certs``

Notable changes in 3.7.17.5

pyexpat / libexpat

* Upgrade bundled libexpat to 2.6.3 to fix CVE-2024-28757, CVE-2024-45490, CVE-2024-45491 and CVE-2024-45492.

Notable changes in 3.7.17.6

pyexpat / libexpat

* Upgrade bundled libexpat to 2.6.4 to fix CVE-2024-50602.

Notable changes in 3.7.17.7

Fixes for these CVEs:

CVE-2023-27043

A vulnerability in Python's email module (up to version 3.11.3) causes incorrect parsing of email addresses containing special characters. This flaw misidentifies parts of RFC2822 headers, potentially allowing attackers to bypass domain-based email verification mechanisms in applications that restrict access to specific domains.

NVD

CVE-2024-6232

The tarfile module in CPython is susceptible to a Regular Expression Denial of Service (ReDoS) vulnerability due to inefficient regular expressions used during header parsing. Specifically crafted tar archives can trigger excessive backtracking, leading to significant CPU resource consumption and potential denial of service.

NVD+5SUSE+5linux.oracle.com+5

CVE-2024-7592

A vulnerability in Python's http.cookies module arises when parsing cookie values containing backslashes within quoted strings. The parser employs an algorithm with quadratic complexity, which can be exploited to cause excessive CPU usage, resulting in a denial of service.

NVD+1Ubuntu+1

CVE-2024-9287

In CPython's venv module, improper quoting of path names during virtual environment creation allows for command injection into activation scripts (e.g., source venv/bin/activate). This vulnerability enables attackers to execute arbitrary commands when such a virtual environment is activated. Virtual environments not created by an attacker or not activated before use are unaffected.

starwindsoftware.com+2

Notable changes in 3.7.17.8

hooks and :func:`io.open_code`, :mod:`asyncio` UDP and introspection APIs,

``getpath.py``), and the behavior changes upstream kept to 3.13 and later

(:mod:`base64` decoding, ``Morsel.js_output``).

Notable changes in 3.7.17.9

This ActiveState release moves the 3.7 line from OpenSSL 1.1.1, which

reached its end of life in September 2023, to OpenSSL 3. The ActiveState

3.9 and 3.10 lines already build against OpenSSL 3. The source still

builds against OpenSSL 1.1.1.

ssl

* With OpenSSL 3, a peer that closes the connection without sending a TLS

``close_notify`` alert ends the stream like a plain end of file, as it does

with OpenSSL 1.1.1, instead of raising

``SSLError: unexpected eof while reading``. :data:`ssl.OP_IGNORE_UNEXPECTED_EOF`

is set by default. (:issue:`43794`)

* The error codes table is regenerated per OpenSSL version, so

:class:`ssl.SSLError` reports the right library and reason with OpenSSL 3

instead of misnamed ones such as ``KRB5_S_TKT_NYV``. (:issue:`39953`,

:issue:`40266`, :issue:`43788`)

* :meth:`~ssl.SSLContext.load_cert_chain` no longer calls the password

callback a second time after it fails. (:issue:`43789`)

Behavior changes from OpenSSL 3

These come from OpenSSL 3 itself and match the ActiveState 3.9 and 3.10

lines:

* At OpenSSL's default security level, TLS 1.0 and 1.1 and SHA-1

signatures are refused, and so are RSA keys shorter than 2048 bits on

OpenSSL 3.2 and later (the Platform builds with 3.5), or shorter than 1024

bits on 3.0 and 3.1, whose default level is lower. Connecting to a server

that needs them fails until the context lowers the level, for example with

``ctx.set_ciphers("DEFAULT:@SECLEVEL=0")``.

* Algorithms that OpenSSL 3 moved to its legacy provider are no longer

available unless that provider is loaded through an OpenSSL

configuration file. ``hashlib.new("md4")`` and ``hashlib.new("whirlpool")``

raise :exc:`ValueError`, and they are not listed in

:data:`hashlib.algorithms_available`. MD4 is used for NTLM

authentication.

* Extension modules that link OpenSSL, such as ``cryptography``,

``pyOpenSSL`` and ``psycopg2``, must be built against OpenSSL 3. Older

releases that do not support OpenSSL 3 (for example ``cryptography``

before 35.0) no longer build.

Build

* On Windows, the build copies the OpenSSL DLLs that match the OpenSSL

version in use (``libssl-3.dll`` for 3.x, ``libssl-1_1.dll`` for 1.1),

from its ``bin`` directory when it has one.

#define PY_RELEASE_SERIAL 0

#define PY_VERSION "3.7.17.8"

#define PY_VERSION "3.7.17.9"

IS_LIBRESSL = ssl.OPENSSL_VERSION.startswith('LibreSSL')

IS_OPENSSL_1_1_0 = not IS_LIBRESSL and ssl.OPENSSL_VERSION_INFO >= (1, 1, 0)

IS_OPENSSL_1_1_1 = not IS_LIBRESSL and ssl.OPENSSL_VERSION_INFO >= (1, 1, 1)

IS_OPENSSL_3_0_0 = not IS_LIBRESSL and ssl.OPENSSL_VERSION_INFO >= (3, 0, 0)

PY_SSL_DEFAULT_CIPHERS = sysconfig.get_config_var('PY_SSL_DEFAULT_CIPHERS')

PROTOCOL_TO_TLS_VERSION = {}

OP_SINGLE_ECDH_USE = getattr(ssl, "OP_SINGLE_ECDH_USE", 0)

OP_CIPHER_SERVER_PREFERENCE = getattr(ssl, "OP_CIPHER_SERVER_PREFERENCE", 0)

OP_ENABLE_MIDDLEBOX_COMPAT = getattr(ssl, "OP_ENABLE_MIDDLEBOX_COMPAT", 0)

OP_IGNORE_UNEXPECTED_EOF = getattr(ssl, "OP_IGNORE_UNEXPECTED_EOF", 0)

if not getattr(ssl, f'HAS_{version.name}'):

return False

if IS_OPENSSL_3_0_0 and version < ssl.TLSVersion.TLSv1_2:

# bpo43791: 3.0.0-alpha14 fails with TLSV1_ALERT_INTERNAL_ERROR

return False

# check runtime and dynamic crypto policy settings. A TLS version may

# be compiled in but disabled by a policy or config option.

ctx = ssl.SSLContext()

self.assertLessEqual(patch, 63)

self.assertGreaterEqual(status, 0)

self.assertLessEqual(status, 15)

# Version string as returned by {Open,Libre}SSL, the format might change

if IS_LIBRESSL:

self.assertTrue(s.startswith("LibreSSL {:d}".format(major)),

(s, t, hex(n)))

libressl_ver = f"LibreSSL {major:d}"

if major >= 3:

# 3.x uses 0xMNN00PP0L

openssl_ver = f"OpenSSL {major:d}.{minor:d}.{patch:d}"

else:

self.assertTrue(s.startswith("OpenSSL {:d}.{:d}.{:d}".format(major, minor, fix)),

(s, t, hex(n)))

openssl_ver = f"OpenSSL {major:d}.{minor:d}.{fix:d}"

self.assertTrue(

s.startswith((openssl_ver, libressl_ver)),

(s, t, hex(n))

)

@support.cpython_only

def test_refcycle(self):

# SSLContext also enables these by default

default |= (OP_NO_COMPRESSION | OP_CIPHER_SERVER_PREFERENCE |

OP_SINGLE_DH_USE | OP_SINGLE_ECDH_USE |

OP_ENABLE_MIDDLEBOX_COMPAT)

OP_ENABLE_MIDDLEBOX_COMPAT |

OP_IGNORE_UNEXPECTED_EOF)

self.assertEqual(default, ctx.options)

ctx.options |= ssl.OP_NO_TLSv1

self.assertEqual(default | ssl.OP_NO_TLSv1, ctx.options)

@requires_minimum_version

@requires_tls_version('TLSv1_2')

@requires_tls_version('TLSv1')

def test_min_max_version_mismatch(self):

client_context, server_context, hostname = testing_context()

# client 1.0, server 1.2 (mismatch)

Update internal table of OpenSSL error codes in the ``ssl`` module.

The header files for :mod:`ssl` error codes are now OpenSSL

version-specific. Exceptions will now show correct reason and library

codes. The ``make_ssl_data.py`` script has been rewritten to use OpenSSL's

text file with error codes.

OpenSSL 3.0.0: Don't call the password callback function a second time when

first call has signaled an error condition.

Add :data:`ssl.OP_IGNORE_UNEXPECTED_EOF` constants (OpenSSL 3.0.0)

test_ssl: skip test_min_max_version_mismatch when TLS 1.0 is not available

OpenSSL 3.0.0: Disable testing of legacy protocols TLS 1.0 and 1.1. Tests

are failing with TLSV1_ALERT_INTERNAL_ERROR.