Description

gpshead

opened on Feb 9, 2023

Issue body actions

https://www.openssl.org/news/secadv/20230207.txt
https://nvd.nist.gov/vuln/detail/CVE-2023-0286

The just released binaries on Windows and macOS were all build using 1.1.1s, we need to use 1.1.1t in the release branches.

Linked PRs

• gh-101726: Update the OpenSSL version to 1.1.1t #101727
• [3.11] gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727) #101749
• [3.10] gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727) #101750
• [3.9] gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727) #101751
• [3.8] gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727) #101752
• [3.7] gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727) #101753

Activity

1. gpshead

   added

   type-bugAn unexpected behavior, bug, or errorAn unexpected behavior, bug, or error

   type-securityA security issueA security issue

   release-blocker

   on Feb 9, 2023
2. gpshead

   assigned

   ambv

   ,

   zooba

   and

   pablogsal

   on Feb 9, 2023
3. ezio-melotti

   added this to Release and Deferred blockers 🚫on Feb 9, 2023
4. github-project-automation

   moved this to Todo in Release and Deferred blockers 🚫on Feb 9, 2023
5. gpshead

   added a commit that references this issue on Feb 9, 2023

   pythongh-101726: Update the OpenSSL version to 1.1.1t

   ebf6d30
6. zooba commented on Feb 9, 2023

   

   zooba

   on Feb 9, 2023

   Member

   More actions

   My read of the impact to us:

   • CVE-2023-0286 requires users to enable CRL checking, as it appears that we don't do anything besides provide the constants. Also, from the advisory: "In most cases, the attack requires the attacker to provide both the certificate chain and CRL", which suggests a more appropriate mitigation (don't use an attacker's revocation list :) )
   • CVE-2022-4304 is a timing oracle requiring a very large number of requests. I suspect natural variation would make this infeasible over an actual network, but if it can be demoed, this seems like the biggest issue for us.
   • CVE-2022-4203 requires a CA-signed certificate, and at worst may cause a crash. In any case, doesn't impact OpenSSL 1.1
   • CVE-2023-0215 and CVE-2023-4450 impact BIO_new_NDEF and PEM_read_bio_ex which we neither use nor expose
   • Remaining issues don't affect 1.1

   So I think the only concerning one is the timing oracle, and it doesn't concern me enough to trigger a new round of releases.

   However, I'm also concerned by the near certainty that we'll be criticised (again) for not immediately reacting, so if we'd rather not keep patiently explaining to nervous people that we aren't impacted, we could schedule new releases.

   Reacted by Gregory P. Smith and neilpvirtualitics
7. zooba

   added 4 commits that reference this issue on Feb 9, 2023

   gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727)

   b41c47c

   pythongh-101726: Update the OpenSSL version to 1.1.1t (pythonGH-101727)

   6eb7d45

   pythongh-101726: Update the OpenSSL version to 1.1.1t (pythonGH-101727)

   f42aca4

   pythongh-101726: Update the OpenSSL version to 1.1.1t (pythonGH-101727)

   e5bc753
8. gpshead commented on Feb 9, 2023

   

   gpshead

   on Feb 9, 2023

   MemberAuthor

   More actions

   Thanks for the analysis Steve!

   I agree, this doesn't currently sound like an urgent priority to release. (ie: apparently not a "Critical - everyone is screwed" flaw). It's good to have the commits/PRs ready place so that we can; thanks everyone for jumping on those.

   I expect some people will want it sooner than our next planned releases in April because noteworthy CVEs do tend to trigger non-technical requirements for people to upgrade their software. At least it doesn't feel like we need to rush to cut new releases this week. 😅

   Reacted by Zachary Ware, Steve Dower and neilpvirtualitics
9. zooba

   added 2 commits that reference this issue on Feb 9, 2023

   gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727)

   b8149a9

   gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727)

   52a03a0
10. ned-deily

    added a commit that references this issue on Feb 9, 2023

    [3.7] gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727) (GH…

    cbd192b
11. carljm

    added a commit that references this issue on Feb 10, 2023

    Merge branch 'main' into inlinecomp2

    add772e
12. ned-deily

    added 2 commits that reference this issue on Mar 7, 2023

    [3.9] gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727) (GH…

    bf99e19

    [3.8] gh-101726: Update the OpenSSL version to 1.1.1t (GH-101727) (GH…

    ddd495e
13. ned-deily

    closed this as completedon Mar 7, 2023
14. github-project-automation

    moved this from Todo to Done in Release and Deferred blockers 🚫on Mar 7, 2023
15. carlosroman

    added a commit that references this issue on Jun 22, 2023

    Upgrade to 3.8.17 (#26)

    e0a363f

Issue actions