Bug 1744670

Summary: hashlib.md5 broken in FIPS mode without workaround available
Product: Red Hat Enterprise Linux 8 Reporter: Alicja Kario <hkario>
Component: python3Assignee: Python Maintainers <python-maint>
Status: CLOSED ERRATA QA Contact: Lukáš Zachar <lzachar>
Severity: urgent Docs Contact:
Priority: urgent    
Version: 8.0CC: jkejda, pviktori, torsava, wchadwic
Target Milestone: rcKeywords: Regression
Target Release: 8.0   
Hardware: Unspecified   
OS: Unspecified   
Whiteboard:
Fixed In Version: python3-3.6.8-15.el8 Doc Type: If docs needed, set a value
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2019-11-05 22:03:44 UTC Type: Bug
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Alicja Kario 2019-08-22 16:21:01 UTC 
Description of problem:
It is not possible to use MD5 from hashlib module when system is configured in FIPS mode.

Version-Release number of selected component (if applicable):
python3-libs-3.6.8-14.el8.x86_64
python36-3.6.8-2.module+el8.1.0+3334+5cb623d7.x86_64

How reproducible:
always

Steps to Reproduce:
1. setup system in FIPS mode
2. import hashlib
3. a = hashlib.md5()
4. a = hashlib.md5(usedforsecurity=False)

Actual results:
>>> a = hashlib.md5()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: [digital envelope routines: EVP_DigestInit_ex] disabled for FIPS
>>> a = hashlib.md5(usedforsecurity=False)
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
TypeError: openssl_md5() takes no keyword arguments

Expected results:
>>> a = hashlib.md5()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips
>>> a = hashlib.md5(usedforsecurity=False)
>>> a
<md5 HASH object @ 0x7f7debab5760>

Additional info:
This is a regression compared to RHEL-7 FIPS mode. Disabling access to MD5 completely in FIPS mode is not the intended goal of FIPS. Only use of MD5 to cryptographically protect data is disallowed in FIPS mode (e.g. RSA signatures with MD5).
Comment 1 Alicja Kario 2019-08-22 16:22:36 UTC 
see also bug 1742223
Comment 9 errata-xmlrpc 2019-11-05 22:03:44 UTC 
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHSA-2019:3520