Description

gpshead

opened on Mar 31, 2023

Issue body actions

https://nvd.nist.gov/vuln/detail/CVE-2023-0464

We need OpenSSL >= 1.1.1u | 3.0.9 | 3.1.1.

We've got patch releases coming up soon, we should be able to just bump the versions before then.

(note: at the time of this writing OpenSSL hasn't even released those updated versions)

Linked PRs

• gh-103142: Update error codes, multissltests, and CI workflows for OpenSSL 1.1.1u, 3.0.9, and 3.1.1. #105129
• gh-103142: Update macOS installer to use OpenSSL 1.1.1u. #105130
• [3.11] gh-103142: Update macOS installer to use OpenSSL 1.1.1u. (GH-105130) #105131
• [3.12] gh-103142: Update macOS installer to use OpenSSL 1.1.1u. (GH-105130) #105132
• gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u #105174
• [3.12] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) #105199
• [3.11] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174)  #105200
• [3.10] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) #105204
• [3.9] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) #105205
• [3.7] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u. #105308
• [3.8] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) (GH-105205) #105370

Activity

1. gpshead

   added

   type-securityA security issueA security issue

   release-blocker

   3.11only security fixesonly security fixes

   3.10 (EOL)end of lifeend of life

   3.9 (EOL)end of lifeend of life

   3.8 (EOL)end of lifeend of life

   3.7 (EOL)end of lifeend of life

   on Mar 31, 2023
2. ezio-melotti

   added this to Release and Deferred blockers 🚫on Mar 31, 2023
3. github-project-automation

   moved this to Todo in Release and Deferred blockers 🚫on Mar 31, 2023
4. ambv commented on Apr 3, 2023

   

   ambv

   on Apr 3, 2023

   Contributor

   More actions

   We are still waiting on the upstream OpenSSL release as of today.
5. gpshead commented on Apr 3, 2023

   

   gpshead

   on Apr 3, 2023

   MemberAuthor

   More actions

   https://www.openssl.org/ considers these low severity, so deferring this to not block releases could make sense. Otherwise we'd need to cherry pick a few patches and apply them as part of our build or pull a pre-release tarball from their source control, both of which sound annoying.
6. JelleZijlstra commented on May 15, 2023

   

   JelleZijlstra

   on May 15, 2023

   Member

   More actions

   From https://www.openssl.org/source/ it appears there's no 1.1.1u release yet. Is this still a blocker?
7. gpshead commented on May 15, 2023

   

   gpshead

   on May 15, 2023

   MemberAuthor

   More actions

   wait until the day our releases are being built and bump it back to deferred if upstream openssl hasn't done releases.

   Reacted by Jelle Zijlstra
8. h-vetinari commented on May 15, 2023

   

   h-vetinari

   on May 15, 2023

   Contributor

   More actions

   FYI: Their next release is planned to be in May.
9. gpshead

   added

   topic-SSL

   on May 20, 2023
10. 17 remaining items

11. gpshead commented on Jun 1, 2023

    

    gpshead

    on Jun 1, 2023

    MemberAuthor

    More actions

    Everything back through 3.11 has been updated to build binary releases using OpenSSL 1.1.1u.

    Backports for 3.10 and 3.9 exist as PRs for their respective @pablogsal and @ambv release managers to merge.

    For 3.8 and 3.7 branches, I recommend doing a backport from the 3.9 commit once that PR is merged (if the RMs choose to merge it; we don't build binary releases for versions that old so that's up to them - it's at least useful for other vendors who potentially do?)

    Reacted by h-vetinari
12. gpshead

    assigned

    ambv

    and

    pablogsal

    on Jun 1, 2023
13. ned-deily

    added 2 commits that reference this issue on Jun 5, 2023

    pythongh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u.

    2b24abd

    [3.7] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u. (GH-…

    417ac32
14. ambv

    added 4 commits that reference this issue on Jun 5, 2023

    [3.9] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-1…

    e15de14

    [3.10] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-…

    cb37100

    [3.8] [3.9] pythongh-103142: Upgrade binary builds and CI to OpenSSL …

    4bc744f

    [3.8] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-1…

    43eff24
15. ned-deily commented on Jun 6, 2023

    

    ned-deily

    on Jun 6, 2023

    Member

    More actions

    This has now been backported to 3.8 and 3.7 as well. For 3.7, there is only a partial backport because some of the changes in earlier releases to fully support OpenSSL 3.x were not backported to 3.7.
16. ned-deily

    closed this as completedon Jun 6, 2023
17. github-project-automation

    moved this from Todo to Done in Release and Deferred blockers 🚫on Jun 6, 2023
18. carlosroman

    added a commit that references this issue on Jun 22, 2023

    Upgrade to 3.8.17 (#26)

    e0a363f
19. python

    deleted a comment from keate01 on Jul 20, 2023
20. glebfm

    added a commit that references this issue on Jul 30, 2023

    pythongh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (pyth…

    fa7bccb

Issue actions