Upgrade installers to OpenSSL 1.1.1j

[ned-deily]

BPO	41837
Nosy	@pfmoore, @ronaldoussoren, @tiran, @tjguk, @ned-deily, @ambv, @zware, @zooba, @miss-islington
PRs	bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. #24080 [3.9] bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. (GH-24080) #24083 [3.8] bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. (GH-24080) #24084 bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i #24125 [3.9] bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i (GH-24125) #24127 [3.8] bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i (GH-24125) #24131 bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. #24677 [3.8] bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. (GH-24677) #24678 [3.9] bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. (GH-24677) #24679
Superseder	bpo-43631: Update to OpenSSL 1.1.1k

^{Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.}

Show more details

GitHub fields:

assignee = None
closed_at = <Date 2021-04-05.19:37:40.365>
created_at = <Date 2020-09-23.00:59:08.865>
labels = ['OS-mac', 'type-bug', '3.8', '3.9', '3.10', 'build', 'OS-windows']
title = 'Upgrade installers to OpenSSL 1.1.1j'
updated_at = <Date 2021-04-05.19:37:40.364>
user = 'https://github.com/ned-deily'

bugs.python.org fields:

activity = <Date 2021-04-05.19:37:40.364>
actor = 'ned.deily'
assignee = 'none'
closed = True
closed_date = <Date 2021-04-05.19:37:40.365>
closer = 'ned.deily'
components = ['Build', 'macOS', 'Windows']
creation = <Date 2020-09-23.00:59:08.865>
creator = 'ned.deily'
dependencies = []
files = []
hgrepos = []
issue_num = 41837
keywords = ['patch']
message_count = 20.0
messages = ['377352', '382102', '382149', '382234', '384311', '384315', '384316', '384434', '384442', '384448', '384452', '384590', '384592', '385102', '387353', '387425', '387846', '387848', '387849', '390251']
nosy_count = 10.0
nosy_names = ['paul.moore', 'ronaldoussoren', 'christian.heimes', 'tim.golden', 'ned.deily', 'lukasz.langa', 'zach.ware', 'steve.dower', 'miss-islington', 'squear']
pr_nums = ['24080', '24083', '24084', '24125', '24127', '24131', '24677', '24678', '24679']
priority = None
resolution = 'out of date'
stage = 'resolved'
status = 'closed'
superseder = '43631'
type = 'behavior'
url = 'https://bugs.python.org/issue41837'
versions = ['Python 3.8', 'Python 3.9', 'Python 3.10']

[ned-deily]

"22-Sep-2020 OpenSSL 1.1.1h is now available, including bug fixes"

Christian, any changes need in _ssl or any other reasons we should not upgrade?

Changes between 1.1.1g and 1.1.1h [22 Sep 2020]

*) Certificates with explicit curve parameters are now disallowed in
verification chains if the X509_V_FLAG_X509_STRICT flag is used.
[Tomas Mraz]

*) The 'MinProtocol' and 'MaxProtocol' configuration commands now silently
ignore TLS protocol version bounds when configuring DTLS-based contexts, and
conversely, silently ignore DTLS protocol version bounds when configuring
TLS-based contexts. The commands can be repeated to set bounds of both
types. The same applies with the corresponding "min_protocol" and
"max_protocol" command-line switches, in case some application uses both TLS
and DTLS.

 SSL_CTX instances that are created for a fixed protocol version (e.g.
 TLSv1_server_method()) also silently ignore version bounds.  Previously
 attempts to apply bounds to these protocol versions would result in an
 error.  Now only the "version-flexible" SSL_CTX instances are subject to
 limits in configuration files in command-line options.
 [Viktor Dukhovni]

*) Handshake now fails if Extended Master Secret extension is dropped
on renegotiation.
[Tomas Mraz]

[ned-deily]

Christian, ping?

[tiran]

Sorry, I missed the initial ping.

The changes look unproblematic to me. Our test suite is passing with 1.1.1h, too. Python doesn't set VERIFY_X509_STRICT by default and does not support DTLS.

Please go ahead.

[tiran]

You may want to hold off until next week:

https://mta.openssl.org/pipermail/openssl-announce/2020-December/000186.html

OpenSSL 1.1.i is a security-fix release. The highest severity issue fixed in this release is HIGH.

[ned-deily]

New changeset 14097a2 by Ned Deily in branch 'master':
bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. (GH-24080)
14097a2

[ned-deily]

New changeset f24ac45 by Miss Islington (bot) in branch '3.8':
bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. (GH-24080) (bpo-24084)
f24ac45

[ned-deily]

New changeset 76489dd by Miss Islington (bot) in branch '3.9':
bpo-41837: Update macOS installer build to use OpenSSL 1.1.1i. (GH-24080) (GH-24083)
76489dd

[zooba]

New changeset afb7144 by Steve Dower in branch 'master':
bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i (GH-24125)
afb7144

[zooba]

New changeset c833393 by Steve Dower in branch '3.9':
bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i (GH-24125)
c833393

[zooba]

New changeset 86b1207 by Steve Dower in branch '3.8':
bpo-41837: Updated Windows installer to include OpenSSL 1.1.1i (GH-24125)
86b1207

[zooba]

I believe this is all done now.

[squear]

The fix has only be done for 3.8, 3.9 and 3.10. Are 3.7 and 3.6 are not impacted?

[tiran]

They are impacted. However 3.7.9 and 3.6.8 were the last releases with binaries for Windows and macOS. All subsequent releases are source-only releases. Since we don't release binaries for 3.6 and 3.7 any more, we typically don't update them.

[tiran]

I got bad news. OpenSSL 1.1.1i introduced a regression in cert validation. This affects some cases that involve self-signed certificates. Cert validation fails if a self-signed certificate is used as both a trust anchor (root CA) and EE cert. This may affect Python.

Would it be possible to rebuild our OpenSSL binaries with patch openssl/openssl#13749 ?

[zooba]

Looks like we missed Christian's last message...

Have OpenSSL made an updated release? If this issue is as bad as the short description above sounds, I expect they would have.

It's possible to rebuild with the patch, but easier if it's a release.

(Also, Christian, should this have been a release blocker? We just made fast releases for a security concern...)

[ned-deily]

1.1.1j was issued earlier this week and, from browsing the source, it appears that this fix is included (it's not mentioned as a major issue) along with other fixes. So I assume we just need to update the installers to use 1.1.1j. The question is then do need to push updated installers for 3.9.x and 3.8.x? Setting to "deferred blocker" pending a decision.

@christian? @Łukasz?

[ned-deily]

New changeset 0242494 by Ned Deily in branch 'master':
bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. (GH-24677)
0242494

[miss-islington]

New changeset e2f6ed8 by Miss Islington (bot) in branch '3.8':
bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. (GH-24677)
e2f6ed8

[miss-islington]

New changeset 982e8ec by Miss Islington (bot) in branch '3.9':
bpo-41837: Update macOS installer build to use OpenSSL 1.1.1j. (GH-24677)
982e8ec

[ned-deily]

Now updated to OpenSSL 1.1.1k in bpo-43631