Use of hashlib.sha1 causes issue in FIPS build

[jtrinh27]

The use of SHA1 found here:

flask/src/flask/sessions.py

Line 289 in b90a4f1

digest_method = staticmethod(hashlib.sha1)

prevents applications from running in a FIPS Enabled Environment/OS. The OS will abruptly stop the application from running when it detects a non compliant Hash Algorithm is used.

Describe how to replicate the bug:
Enforce FIPS Enabled on the OS (such as RHEL9)

Unexpected Behavior Error output:

Traceback (most recent call last):
  File "/opt/abc-app/app.py", line 1, in <module>
    from xxxxxxxxxx import xxxxxxx
  File "/opt/abc-app/abc-app_ui.py", line 67, in <module>
    sess.init_app(app=app)
  File "/opt/abc-app/venv/lib/python3.11/site-packages/flask_session/__init__.py", line 50, in init_app
    app.session_interface = self._get_interface(app)
                            ^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/abc-app/venv/lib/python3.11/site-packages/flask_session/__init__.py", line 79, in _get_interface
    session_interface = FileSystemSessionInterface(
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/abc-app/venv/lib/python3.11/site-packages/flask_session/sessions.py", line 312, in __init__
    self.cache = FileSystemCache(cache_dir, threshold=threshold, mode=mode)
                 ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/abc-app/venv/lib/python3.11/site-packages/cachelib/file.py", line 73, in __init__
    self._update_count(value=len(list(self._list_dir())))
  File "/opt/abc-app/venv/lib/python3.11/site-packages/cachelib/file.py", line 95, in _update_count
    self.set(self._fs_count_file, new_count, mgmt_element=True)
  File "/opt/abc-app/venv/lib/python3.11/site-packages/cachelib/file.py", line 244, in set
    filename = self._get_filename(key)
               ^^^^^^^^^^^^^^^^^^^^^^^
  File "/opt/abc-app/venv/lib/python3.11/site-packages/cachelib/file.py", line 201, in _get_filename
    bkey_hash = self._hash_method(bkey).hexdigest()
                ^^^^^^^^^^^^^^^^^^^^^^^
_hashlib.UnsupportedDigestmodError: [digital envelope routines] unsupported

Environment:
RHEL9 FIPS Enabled and Enforced

• Python version: 3.x
• Flask version: 3.0.2

[davidism]

Already reported to cachelib: pallets-eco/cachelib#361

[davidism]

Wait nevermind, the traceback is for Flask-Session but you're pointing at Flask code in the link. So the problem is that the default of sha1 causes hashlib to raise an error before it's possible to override that, so even if the user wants to choose something other than the default they can't do that in time.

[davidism]

Looking into this more, only MD5 is called out as not being available in FIPS mode: https://docs.python.org/3/library/hashlib.html#hash-algorithms. Has this changed recently to include SHA-1? If so, you should report that to Python as well to update the documentation to reflect what FIPS actually does.

I found this announcement https://www.nist.gov/news-events/news/2022/12/nist-retires-sha-1-cryptographic-algorithm which states that FIPS 180-5 will be released by 2030, but I can't find anything detailing how you'd get a FIPS build of OpenSSL that doesn't support SHA-1 today. I need some more info on how OpenSSL/Python is being built, because it looks like the build is different than what FIPS actually requires.