Bug 976661

Summary:	python-webob fails to generate http body md5 hash in fips mode
Product:	Red Hat Enterprise Linux 7	Reporter:	Bohuslav "Slavek" Kabrda <bkabrda>
Component:	python-webob	Assignee:	Charalampos Stratakis <cstratak>
Status:	CLOSED ERRATA	QA Contact:	Jan Kepler <jkejda>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	7.0	CC:	bnater, cstratak, isenfeld, omoris, pviktori
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	python-webob-1.2.3-7.el7	Doc Type:	No Doc Update
Doc Text:	undefined	Story Points:	---
Clone Of:		Environment:
Last Closed:	2017-08-01 17:58:28 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	839624, 1380359, 1393868

Description Bohuslav "Slavek" Kabrda 2013-06-21 06:48:59 UTC

Since MD5 is used for generating hash of message body, python-webob fails in fips mode when trying to do so. IMHO this could be modified by using "usedforsecurity=False" parameter, since as the standard states, "MIC is good for detecting accidental modification of the entity-body in transit, but is not proof against malicious attacks" [1].

[1] http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.15

Comment 2 Miloslav Trmač 2013-06-21 19:24:01 UTC

(In reply to Bohuslav "Slavek" Kabrda from comment #0)
> Since MD5 is used for generating hash of message body, python-webob fails in
> fips mode when trying to do so. IMHO this could be modified by using
> "usedforsecurity=False" parameter, since as the standard states, "MIC is
> good for detecting accidental modification of the entity-body in transit,
> but is not proof against malicious attacks" [1].

Yes.

Comment 5 Charalampos Stratakis 2017-01-24 13:24:12 UTC

So in order to reproduce this issue, a rhel 7 machine with fips mode enabled and python-webob and python-nose installed, is required.

From python-webob sources copy the test_response.py file somewhere to the testing machine (as this file is not installed with the package) and invoke the tests with: nosetests test_response.py

3 tests will fail while in fips mode.

======================================================================
ERROR: test_response.test_response_copy_content_md5
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/nose/case.py", line 197, in runTest
    self.test(*self.arg)
  File "/home/harris/Desktop/test_response.py", line 146, in test_response_copy_content_md5
    res.md5_etag(set_content_md5=True)
  File "/usr/lib/python2.7/site-packages/webob/response.py", line 1000, in md5_etag
    md5_digest = md5(body).digest()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

======================================================================
ERROR: test_response.test_md5_etag
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/nose/case.py", line 197, in runTest
    self.test(*self.arg)
  File "/home/harris/Desktop/test_response.py", line 270, in test_md5_etag
    res.md5_etag()
  File "/usr/lib/python2.7/site-packages/webob/response.py", line 1000, in md5_etag
    md5_digest = md5(body).digest()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

======================================================================
ERROR: test_response.test_md5_etag_set_content_md5
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/nose/case.py", line 197, in runTest
    self.test(*self.arg)
  File "/home/harris/Desktop/test_response.py", line 280, in test_md5_etag_set_content_md5
    res.md5_etag(body, set_content_md5=True)
  File "/usr/lib/python2.7/site-packages/webob/response.py", line 1000, in md5_etag
    md5_digest = md5(body).digest()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

This can be fixed at the response.py file of webob, by adding the keyword 'usedforsecurity=False' when generating an etag for the response object using an MD5 hash of the body, so the line 'md5_digest = md5(body).digest()' will need to be changed to 'md5_digest = md5(body, usedforsecurity=False).digest()' at the 'def md5_etag' function.

Comment 9 errata-xmlrpc 2017-08-01 17:58:28 UTC

Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1890