Bug 1222024

Summary: InsecurePlatformWarning: A true SSLContext object is not available
Product: [Fedora] Fedora Reporter: Harald Reindl <h.reindl>
Component: python-fedoraAssignee: Fedora Infrastructure SIG <infra-sig>
Status: CLOSED CURRENTRELEASE QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: unspecified Docs Contact:
Priority: unspecified    
Version: 21CC: cheese, infra-sig, jonstanley, lmacken, opensource, pp, rbean, relrod, ricky
Target Milestone: ---   
Target Release: ---   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
: 1229387 (view as bug list) Environment:
Last Closed: 2015-06-17 19:40:37 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1229387    

Description Harald Reindl 2015-05-15 13:57:43 UTC 
that warning appear for weeks now

Waiting for Bodhi for a list of packages in updates-testing (F21)...
/usr/lib/python2.7/site-packages/requests/packages/urllib3/util/ssl_.py:90: InsecurePlatformWarning: A true SSLContext object is not available. This prevents urllib3 from configuring SSL appropriately and may cause certain SSL connections to fail. For more information, see https://urllib3.readthedocs.org/en/latest/security.html#insecureplatformwarning.
  InsecurePlatformWarning
Comment 1 Till Maas 2015-05-15 15:01:28 UTC 
I guess this is a problem in python-fedora or maybe urllib3, but most likely not in fedora-easy-karma direclty.
Comment 2 Pekka Pietikäinen 2015-06-05 06:05:47 UTC 
It's messier than that, real fix would be to update Fedora 21 to python 2.7.9 (or .10), downgrade/patch python-requests and python-urllib3 to versions that don't care or just disable the warnings per package...
Comment 3 Ralph Bean 2015-06-05 20:42:02 UTC 
Alternatively, we could build python-urllib3 against pyOpenSSL and patch it to inject the pyOpenSSL hooks at import-time (just for F21).
Comment 4 Fedora Update System 2015-06-08 14:40:56 UTC 
python-requests-2.7.0-1.fc21,python-urllib3-1.10.4-3.20150503gita91975b.fc21 has been submitted as an update for Fedora 21.
https://admin.fedoraproject.org/updates/python-requests-2.7.0-1.fc21,python-urllib3-1.10.4-3.20150503gita91975b.fc21
Comment 5 Pekka Pietikäinen 2015-06-08 17:31:14 UTC 
Quick testing suggests the patch makes the warning go away (and probably now apps using urllib3/requests now do TLS "correctly" by default). Suppose some "regression" with self-signed certs/legacy servers may occur, but that is a small price for getting things secure ;-)

If I read the spec/patch correctly, pyOpenSSL gets used even with Python 3, which may not be desired (seems to work fine anyway)
Comment 6 Fedora Update System 2015-06-18 13:23:20 UTC 
python-requests-2.7.0-1.fc21, python-urllib3-1.10.4-3.20150503gita91975b.fc21 has been pushed to the Fedora 21 stable repository.  If problems still persist, please make note of it in this bug report.