Skip to content

Commit e15de14

Browse files
gpsheadned-deily
gpshead
and
ned-deily
authored
[3.9] pythongh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (pythonGH-105174) (pythonGH-105200) (python#105205)
Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af) Co-authored-by: Ned Deily <nad@python.org>
1 parent c9bf00b commit e15de14

File tree

12 files changed

+186
-18
lines changed

12 files changed

+186
-18
lines changed

‎.azure-pipelines/ci.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
variables:
5858
testRunTitle: '$(build.sourceBranchName)-linux'
5959
testRunPlatform: linux
60-
openssl_version: 1.1.1t
60+
openssl_version: 1.1.1u
6161

6262
steps:
6363
- template: ./posix-steps.yml
@@ -83,7 +83,7 @@ jobs:
8383
variables:
8484
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
8585
testRunPlatform: linux-coverage
86-
openssl_version: 1.1.1t
86+
openssl_version: 1.1.1u
8787

8888
steps:
8989
- template: ./posix-steps.yml

‎.azure-pipelines/pr.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -57,7 +57,7 @@ jobs:
5757
variables:
5858
testRunTitle: '$(system.pullRequest.TargetBranch)-linux'
5959
testRunPlatform: linux
60-
openssl_version: 1.1.1t
60+
openssl_version: 1.1.1u
6161

6262
steps:
6363
- template: ./posix-steps.yml
@@ -83,7 +83,7 @@ jobs:
8383
variables:
8484
testRunTitle: '$(Build.SourceBranchName)-linux-coverage'
8585
testRunPlatform: linux-coverage
86-
openssl_version: 1.1.1t
86+
openssl_version: 1.1.1u
8787

8888
steps:
8989
- template: ./posix-steps.yml

‎.github/workflows/build.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -177,7 +177,7 @@ jobs:
177177
needs: check_source
178178
if: needs.check_source.outputs.run_tests == 'true'
179179
env:
180-
OPENSSL_VER: 1.1.1t
180+
OPENSSL_VER: 1.1.1u
181181
PYTHONSTRICTEXTENSIONBUILD: 1
182182
steps:
183183
- uses: actions/checkout@v3
@@ -219,7 +219,7 @@ jobs:
219219
strategy:
220220
fail-fast: false
221221
matrix:
222-
openssl_ver: [1.0.2u, 1.1.0l, 1.1.1t, 3.0.8, 3.1.0-beta1]
222+
openssl_ver: [1.0.2u, 1.1.0l, 1.1.1u, 3.0.9, 3.1.1]
223223
env:
224224
OPENSSL_VER: ${{ matrix.openssl_ver }}
225225
MULTISSL_DIR: ${{ github.workspace }}/multissl

‎Mac/BuildScript/build-installer.py

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -244,9 +244,9 @@ def library_recipes():
244244

245245
result.extend([
246246
dict(
247-
name="OpenSSL 1.1.1t",
248-
url="https://www.openssl.org/source/openssl-1.1.1t.tar.gz",
249-
checksum='1cfee919e0eac6be62c88c5ae8bcd91e',
247+
name="OpenSSL 1.1.1u",
248+
url="https://www.openssl.org/source/openssl-1.1.1u.tar.gz",
249+
checksum='72f7ba7395f0f0652783ba1089aa0dcc',
250250
buildrecipe=build_universal_openssl,
251251
configure=None,
252252
install=None,

‎Misc/NEWS.d/next/Security/2023-06-01-03-24-58.gh-issue-103142.GLWDMX.rst

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
The version of OpenSSL used in our binary builds has been upgraded to 1.1.1u
2+
to address several CVEs.

‎Misc/NEWS.d/next/macOS/2023-05-30-23-30-46.gh-issue-103142.55lMXQ.rst

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
Update macOS installer to use OpenSSL 1.1.1u.

‎Modules/_ssl_data_111.h

Lines changed: 16 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2021-04-09T09:36:21.493286 */
1+
/* File generated by Tools/ssl/make_ssl_data.py *//* Generated on 2023-06-01T02:58:04.081473 */
22
static struct py_ssl_library_code library_codes[] = {
33
#ifdef ERR_LIB_ASN1
44
{"ASN1", ERR_LIB_ASN1},
@@ -1375,6 +1375,11 @@ static struct py_ssl_error_code error_codes[] = {
13751375
#else
13761376
{"UNSUPPORTED_COMPRESSION_ALGORITHM", 46, 151},
13771377
#endif
1378+
#ifdef CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM
1379+
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM},
1380+
#else
1381+
{"UNSUPPORTED_CONTENT_ENCRYPTION_ALGORITHM", 46, 194},
1382+
#endif
13781383
#ifdef CMS_R_UNSUPPORTED_CONTENT_TYPE
13791384
{"UNSUPPORTED_CONTENT_TYPE", ERR_LIB_CMS, CMS_R_UNSUPPORTED_CONTENT_TYPE},
13801385
#else
@@ -4860,6 +4865,11 @@ static struct py_ssl_error_code error_codes[] = {
48604865
#else
48614866
{"MISSING_PARAMETERS", 20, 290},
48624867
#endif
4868+
#ifdef SSL_R_MISSING_PSK_KEX_MODES_EXTENSION
4869+
{"MISSING_PSK_KEX_MODES_EXTENSION", ERR_LIB_SSL, SSL_R_MISSING_PSK_KEX_MODES_EXTENSION},
4870+
#else
4871+
{"MISSING_PSK_KEX_MODES_EXTENSION", 20, 310},
4872+
#endif
48634873
#ifdef SSL_R_MISSING_RSA_CERTIFICATE
48644874
{"MISSING_RSA_CERTIFICATE", ERR_LIB_SSL, SSL_R_MISSING_RSA_CERTIFICATE},
48654875
#else
@@ -5065,6 +5075,11 @@ static struct py_ssl_error_code error_codes[] = {
50655075
#else
50665076
{"NULL_SSL_METHOD_PASSED", 20, 196},
50675077
#endif
5078+
#ifdef SSL_R_OCSP_CALLBACK_FAILURE
5079+
{"OCSP_CALLBACK_FAILURE", ERR_LIB_SSL, SSL_R_OCSP_CALLBACK_FAILURE},
5080+
#else
5081+
{"OCSP_CALLBACK_FAILURE", 20, 294},
5082+
#endif
50685083
#ifdef SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED
50695084
{"OLD_SESSION_CIPHER_NOT_RETURNED", ERR_LIB_SSL, SSL_R_OLD_SESSION_CIPHER_NOT_RETURNED},
50705085
#else

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy