-
Notifications
You must be signed in to change notification settings - Fork 426
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
SSLv3 problem #1704
Comments
This is probably the same as Debian bug #770276, reported yesterday. |
Btw, as a very temporary workaround (for local environments where SSL is not required or used anyway), changing |
Not a bug in this project. |
Isn't that exactly why we have the (To track bugs which should be fixed upstream, but we still need to track them, because they impact our project, and we will need to update our dependency requirements eventually?) |
Which upstream project is there a bug in? Debian is not a dependency of this project. |
I am guessing gevent, or gunicorn. |
Gevent is using a constant from the Python standard library that is still defined: https://github.com/python/cpython/blob/08802a11fdb844a5aaec3a1dc67d8281d582d22b/Modules/_ssl.c#L4465 Not only is it defined on the most recent tip of the Python source, it's not even wrapped in a conditional preprocessor macro. It should be always there. So it seems like maybe Debian patched and removed it.
|
Yes. They did this. Whether or not it was a prudent decision is debatable, but given the recent problems with SSL3, I think it's reasonable to assume that a significant percentage of distributions will go down that way. Comparing the global influence of Debian and gevent, I would say that now it's up to gevent to adapt. So... even if it's not really a bug in gevent, the fix should happen in gevent, which is a dependency of us. |
I have reported the problem to gevent here: gevent/gevent#513 |
I can't even find this in Debian. Looking at packages.debian.org (https://packages.debian.org/sid/python) I see: wheezy: 2.7.3-4+deb7u1 How did you even get this package (2.7.8-12)? |
Check https://packages.debian.org/search?keywords=python2.7 or https://packages.qa.debian.org/p/python2.7.html. |
Investigating further, the place this is used is In other words, the only reason this affects us at all is that Debian removed a constant that is supposed to be there. As far as I'm concerned that's a ridiculous thing to do. The actual SSL functions can raise errors when given improper values. If they had simply removed the SSLv3 support in their OpenSSL without removing these flags in Python, everything would be fine. Considering that this change hasn't even made it into wheezy or jessie, I'm going to say that sid is called "unstable" for a reason and this is it. Use it at your own risk. In this case, I hope they revert this patch. In the meantime, I'm not clogging up this issue tracker with reports about one distributions dubious, compatibility-breaking patch on their unstable line version of Python. Thanks for reporting it to gevent. I'll go there and add this link, too: http://bugs.python.org/issue20896 Again, we're talking about a constant that's documented as public and still in upstream Python and a distro that removed it only in their unstable release. |
Currently, this constant is also removed in Debian Jessie, the testing-and-very-soon-to-be-stable release, so it's not just Sid/unstable that is impacted. I believe Debian has patched their See mistio/mist-ce#434 for more details. Note that I described this as Debian wankery, so I am sympathetic to the closure of this issue. |
The problem has been worked around in upstream vanilla gevent, too (see gevent/gevent#517); now we just need a new stable release of gevent. |
Ah, good to know, thanks! |
When trying to launch latest master on my system, I get this:
I guess it's because of the POODLE thingie ...
Can we adapt gunicorn / gevent? (Or has it already been done, and we just need to pick up newer dependencies?)
The text was updated successfully, but these errors were encountered: