Bug 1227505
| Summary: | Fix exception handling when loading a private key | ||||||
|---|---|---|---|---|---|---|---|
| Product: | Red Hat Enterprise Linux 7 | Reporter: | Arie Bregman <abregman> | ||||
| Component: | pyOpenSSL | Assignee: | Tomas Mraz <tmraz> | ||||
| Status: | CLOSED ERRATA | QA Contact: | Hubert Kario <hkario> | ||||
| Severity: | high | Docs Contact: | |||||
| Priority: | medium | ||||||
| Version: | 7.3 | CC: | goeran, hkario, ihrachys, nmavrogi, rcernin, tmraz | ||||
| Target Milestone: | rc | Keywords: | FastFix | ||||
| Target Release: | --- | ||||||
| Hardware: | All | ||||||
| OS: | Linux | ||||||
| Whiteboard: | |||||||
| Fixed In Version: | pyOpenSSL-0.13.1-4.el7 | Doc Type: | If docs needed, set a value | ||||
| Doc Text: | Story Points: | --- | |||||
| Clone Of: | Environment: | ||||||
| Last Closed: | 2018-10-30 09:48:30 UTC | Type: | Bug | ||||
| Regression: | --- | Mount Type: | --- | ||||
| Documentation: | --- | CRM: | |||||
| Verified Versions: | Category: | --- | |||||
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |||||
| Cloudforms Team: | --- | Target Upstream Version: | |||||
| Embargoed: | |||||||
| Bug Depends On: | |||||||
| Bug Blocks: | 1563605 | ||||||
| Attachments: |
|
||||||
The upstream completely changed the way the pyOpenSSL is written I do not think it is possible to rebase to 0.14 in RHEL-7. OK, if not a rebase, can we bisect a patch that fixes the test case and consider it for a backport? Yes, fixing this via specific patch is definitely the way to go. I believe this will resolve the problem: https://github.com/pyca/pyopenssl/commit/56b2fb8abb3ea3d846bb336a7bc25fa2b0a9c0d9 From changelog: "* OpenSSL/crypto/crypto.c: Allow exceptions from passphrase callbacks to propagate up out of load_privatekey" Please let me know if any additional information needed. This seems to be doable. You'll probably need to verify whether the backport fixes the problem yourself. No problem. Once this specific patch is in, I'll test it. Why is this being delayed for so many releases? Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2018:3106 |
Created attachment 1034008 [details] test_parser_cert Description of problem: When running different tests in openstack components from upstream, I receive the following error: "bad password read" while expecting to different result Apparently major changes introduced in 0.14 version, but the latest available pyOpenSSL rpm for rhel 7.x is 0.13.1-4 Version-Release number of selected component (if applicable): 0.13.1 How reproducible: 100% Steps to Reproduce: 1. yum install pyOpenSSL on rhel 7.x machine 2. Download test_cert_parser attached to this bug 3. Run it: python test_cert_parser.py Actual results: OpenSSL.crypto.Error: [(None, 'UI_set_result', 'result too small'), ('PEM routines', 'PEM_def_callback', 'problems getting password'), ('PEM routines', 'PEM_READ_BIO_PRIVATEKEY', 'bad password read')] Expected results: Allow exceptions from passphrase callbacks to propagate up out of load_privatekey