Update OpenSSL used in binary releases per CVE-2023-0464 #103142

gpshead · 2023-03-31T00:37:09Z

https://nvd.nist.gov/vuln/detail/CVE-2023-0464

We need OpenSSL >= 1.1.1u | 3.0.9 | 3.1.1.

We've got patch releases coming up soon, we should be able to just bump the versions before then.

(note: at the time of this writing OpenSSL hasn't even released those updated versions)

Linked PRs

gh-103142: Update error codes, multissltests, and CI workflows for OpenSSL 1.1.1u, 3.0.9, and 3.1.1. #105129
gh-103142: Update macOS installer to use OpenSSL 1.1.1u. #105130
[3.11] gh-103142: Update macOS installer to use OpenSSL 1.1.1u. (GH-105130) #105131
[3.12] gh-103142: Update macOS installer to use OpenSSL 1.1.1u. (GH-105130) #105132
gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u #105174
[3.12] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) #105199
[3.11] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) #105200
[3.10] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) #105204
[3.9] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) #105205
[3.7] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u. #105308
[3.8] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) (GH-105205) #105370

ambv · 2023-04-03T16:00:37Z

We are still waiting on the upstream OpenSSL release as of today.

gpshead · 2023-04-03T17:30:59Z

https://www.openssl.org/ considers these low severity, so deferring this to not block releases could make sense. Otherwise we'd need to cherry pick a few patches and apply them as part of our build or pull a pre-release tarball from their source control, both of which sound annoying.

JelleZijlstra · 2023-05-15T00:29:07Z

From https://www.openssl.org/source/ it appears there's no 1.1.1u release yet. Is this still a blocker?

gpshead · 2023-05-15T01:10:24Z

wait until the day our releases are being built and bump it back to deferred if upstream openssl hasn't done releases.

h-vetinari · 2023-05-15T03:05:18Z

FYI: Their next release is planned to be in May.

gpshead · 2023-05-20T18:22:23Z

I hope they do that, we're currently planning to cut 3.11.4 in the first week of June per https://peps.python.org/pep-0664/.

h-vetinari · 2023-05-31T00:16:30Z

We need OpenSSL >= 1.1.1u | 3.0.9 | 3.1.1.

These were all released a few hours ago.

…nGH-105130) (cherry picked from commit f90d3f6) Co-authored-by: Ned Deily <nad@python.org>

…05131) (cherry picked from commit f90d3f6) Co-authored-by: Ned Deily <nad@python.org>

…05132) (cherry picked from commit f90d3f6) Co-authored-by: Ned Deily <nad@python.org>

Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). backports of this prior to 3.12 will not include the openssl 3.1 header.

…onGH-105174) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). backports of this prior to 3.12 will not include the openssl 3.1 header. (cherry picked from commit ede89af) Co-authored-by: Gregory P. Smith <greg@krypto.org>

…105174) (#105199) gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). backports of this prior to 3.12 will not include the openssl 3.1 header. (cherry picked from commit ede89af) Co-authored-by: Gregory P. Smith [Google] <greg@krypto.org>

pythonGH-105174) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9, and adds a new _ssl_data_31.h file from 3.1.1 along with the ssl.c code to use it. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). backports of this prior to 3.12 will not include the openssl 3.1 header.. (cherry picked from commit ede89af) Co-authored-by: Gregory P. Smith <greg@krypto.org>

…105174) (#105200) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af)

…L 1.1.1u (pythonGH-105174) (pythonGH-105200) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af). (cherry picked from commit a5d2b54) Co-authored-by: Gregory P. Smith <greg@krypto.org>

…pythonGH-105174) (python#105200) Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af)

…nGH-105130)

gpshead · 2023-06-01T20:21:26Z

Everything back through 3.11 has been updated to build binary releases using OpenSSL 1.1.1u.

Backports for 3.10 and 3.9 exist as PRs for their respective @pablogsal and @ambv release managers to merge.

For 3.8 and 3.7 branches, I recommend doing a backport from the 3.9 commit once that PR is merged (if the RMs choose to merge it; we don't build binary releases for versions that old so that's up to them - it's at least useful for other vendors who potentially do?)

…105308)

…05174) (GH-105200) (#105205) Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af) Co-authored-by: Ned Deily <nad@python.org>

…105174) (GH-105200) (#105204) Upgrade builds to OpenSSL 1.1.1u. This OpenSSL version addresses a pile if less-urgent CVEs since 1.1.1t. The Mac/BuildScript/build-installer.py was already updated. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af). (cherry picked from commit a5d2b54) (cherry picked from commit f90d3f6) Co-authored-by: Gregory P. Smith <greg@krypto.org>

…1.1.1u (pythonGH-105174) (pythonGH-105200) (pythonGH-105205) Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af) (cherry picked from commit e15de14) Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Ned Deily <nad@python.org>

…05174) (GH-105200) (GH-105205) (#105370) Upgrade builds to OpenSSL 1.1.1u. Also updates _ssl_data_111.h from OpenSSL 1.1.1u, _ssl_data_300.h from 3.0.9. Manual edits to the _ssl_data_300.h file prevent it from removing any existing definitions in case those exist in some peoples builds and were important (avoiding regressions during backporting). (cherry picked from commit ede89af) (cherry picked from commit e15de14) Co-authored-by: Gregory P. Smith <greg@krypto.org> Co-authored-by: Ned Deily <nad@python.org>

ned-deily · 2023-06-06T16:35:01Z

This has now been backported to 3.8 and 3.7 as well. For 3.7, there is only a partial backport because some of the changes in earlier releases to fully support OpenSSL 3.x were not backported to 3.7.

gpshead added type-security A security issue release-blocker 3.11 bug and security fixes 3.10 only security fixes 3.9 only security fixes 3.8 only security fixes 3.7 only security fixes labels Mar 31, 2023

gpshead added the topic-SSL label May 20, 2023

arhadthedev added 3.12 bugs and security fixes 3.13 new features, bugs and security fixes labels May 22, 2023

This was referenced May 31, 2023

gh-103142: Update error codes, multissltests, and CI workflows for OpenSSL 1.1.1u, 3.0.9, and 3.1.1. #105129

Closed

gh-103142: Update macOS installer to use OpenSSL 1.1.1u. #105130

Merged

ned-deily added a commit that referenced this issue May 31, 2023

gh-103142: Update macOS installer to use OpenSSL 1.1.1u. (GH-105130)

f90d3f6

bedevere-bot mentioned this issue May 31, 2023

[3.11] gh-103142: Update macOS installer to use OpenSSL 1.1.1u. (GH-105130) #105131

Merged

miss-islington pushed a commit to miss-islington/cpython that referenced this issue May 31, 2023

pythongh-103142: Update macOS installer to use OpenSSL 1.1.1u. (pytho…

97fe964

…nGH-105130) (cherry picked from commit f90d3f6) Co-authored-by: Ned Deily <nad@python.org>

bedevere-bot mentioned this issue May 31, 2023

[3.12] gh-103142: Update macOS installer to use OpenSSL 1.1.1u. (GH-105130) #105132

Merged

miss-islington pushed a commit to miss-islington/cpython that referenced this issue May 31, 2023

pythongh-103142: Update macOS installer to use OpenSSL 1.1.1u. (pytho…

06fbd89

…nGH-105130) (cherry picked from commit f90d3f6) Co-authored-by: Ned Deily <nad@python.org>

ned-deily added a commit that referenced this issue May 31, 2023

[3.11] gh-103142: Update macOS installer to use OpenSSL 1.1.1u. (GH-1…

67a8469

…05131) (cherry picked from commit f90d3f6) Co-authored-by: Ned Deily <nad@python.org>

ned-deily added a commit that referenced this issue May 31, 2023

[3.12] gh-103142: Update macOS installer to use OpenSSL 1.1.1u. (GH-1…

e3fcd9e

…05132) (cherry picked from commit f90d3f6) Co-authored-by: Ned Deily <nad@python.org>

bedevere-bot mentioned this issue May 31, 2023

gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u #105174

Merged

bedevere-bot mentioned this issue Jun 1, 2023

[3.12] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) #105199

Merged

bedevere-bot mentioned this issue Jun 1, 2023

[3.11] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) #105200

Merged

bedevere-bot mentioned this issue Jun 1, 2023

[3.10] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) #105204

Merged

gpshead pushed a commit to gpshead/cpython that referenced this issue Jun 1, 2023

pythongh-103142: Update macOS installer to use OpenSSL 1.1.1u. (pytho…

fa24ba2

…nGH-105130)

bedevere-bot mentioned this issue Jun 1, 2023

[3.9] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) #105205

Merged

gpshead assigned ambv and pablogsal Jun 1, 2023

ned-deily added a commit to ned-deily/cpython that referenced this issue Jun 5, 2023

pythongh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u.

2b24abd

bedevere-bot mentioned this issue Jun 5, 2023

[3.7] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u. #105308

Merged

ned-deily added a commit that referenced this issue Jun 5, 2023

[3.7] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u. (GH-…

417ac32

…105308)

erlend-aasland mentioned this issue Jun 6, 2023

3.12 backport gh 105236 #105358

Closed

bedevere-bot mentioned this issue Jun 6, 2023

[3.8] gh-103142: Upgrade binary builds and CI to OpenSSL 1.1.1u (GH-105174) (GH-105200) (GH-105205) #105370

Merged

ned-deily closed this as completed Jun 6, 2023

Update OpenSSL used in binary releases per CVE-2023-0464 #103142

Update OpenSSL used in binary releases per CVE-2023-0464 #103142

gpshead commented Mar 31, 2023 •

edited by bedevere-bot

ambv commented Apr 3, 2023

gpshead commented Apr 3, 2023

JelleZijlstra commented May 15, 2023

gpshead commented May 15, 2023

h-vetinari commented May 15, 2023

gpshead commented May 20, 2023

h-vetinari commented May 31, 2023

gpshead commented Jun 1, 2023

ned-deily commented Jun 6, 2023

Update OpenSSL used in binary releases per CVE-2023-0464 #103142

Update OpenSSL used in binary releases per CVE-2023-0464 #103142

Comments

gpshead commented Mar 31, 2023 • edited by bedevere-bot

Linked PRs

ambv commented Apr 3, 2023

gpshead commented Apr 3, 2023

JelleZijlstra commented May 15, 2023

gpshead commented May 15, 2023

h-vetinari commented May 15, 2023

gpshead commented May 20, 2023

h-vetinari commented May 31, 2023

gpshead commented Jun 1, 2023

ned-deily commented Jun 6, 2023

gpshead commented Mar 31, 2023 •

edited by bedevere-bot