Bug 1747490
| Summary: | python-ply is not FIPS compatible: local variable 'sig' referenced before assignment | ||
|---|---|---|---|
| Product: | Red Hat Enterprise Linux 8 | Reporter: | Christian Heimes <cheimes> |
| Component: | python-ply | Assignee: | Christian Heimes <cheimes> |
| Status: | CLOSED ERRATA | QA Contact: | Kaleem <ksiddiqu> |
| Severity: | unspecified | Docs Contact: | David Voženílek <dvozenil> |
| Priority: | unspecified | ||
| Version: | 8.1 | CC: | cheimes, kresss, ksiddiqu, mkosek, myusuf, pcech, pvoborni, slaznick |
| Target Milestone: | rc | Flags: | pm-rhel:
mirror+
|
| Target Release: | 8.2 | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | |||
| Fixed In Version: | python-ply-3.9-8.el8 | Doc Type: | Known Issue |
| Doc Text: |
.`python-ply` is not FIPS compatible
The YACC module of the `python-ply` package uses the MD5 hashing algorithm to generate the fingerprint of a YACC signature. However, FIPS mode blocks the use of MD5, which is only allowed in non-security contexts. As a consequence, python-ply is not FIPS compatible. On a system in FIPS mode, all calls to `ply.yacc.yacc()` fail with the error message:
----
UnboundLocalError: local variable 'sig' referenced before assignment
----
The problem affects `python-pycparser` and some use cases of `python-cffi`. To work around this problem, modify the line 2966 of the file `/usr/lib/python3.6/site-packages/ply/yacc.py`, replacing `sig = md5()` with `sig = md5(usedforsecurity=False)`. As a result, `python-ply` can be used in FIPS mode.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | 2020-04-28 16:52:09 UTC | Type: | Bug |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 1759827, 1760850 | ||
|
Description
Christian Heimes
2019-08-30 14:51:34 UTC
After updating the signature algorithm to not use MD5, all packages with a yacc / parser table must be updated and regenerate the table. The update affects all packages with a module level variable "_lr_signature". Known packages are * python3-pycparser-2.14-14.el8 * python3-bind-9.11.4-26.P2.el8 We have two options to address this problem 1) Rebase the package to a newer version that does not use MD5. 2) Patch the package and add "usedforsecurity=False" to MD5 call. Option (1) is a clean solution but it requires also to rebuild two other packages, e.g. python-pycparser #1759827. There is a also a small risk that updating will interfere with customer code. Option (2) is a simpler solution and has no risk to customer code. python-yacc uses MD5 to create a finger print of the YACC table. It's not security relevant as it's only used to detect changes and to trigger a rebuild of pre-cached files. FIPS compatibility issue fixed in python-ply-3.9-8.el8. Yes, that's sufficient to verify the fix. IPA installation succeed in FIPS mode. Hence marking the bug as verified. Since the problem described in this bug report should be resolved in a recent advisory, it has been closed with a resolution of ERRATA. For information on the advisory, and where to find the updated files, follow the link below. If the solution does not work for you, open a new bug report. https://access.redhat.com/errata/RHBA-2020:1842 |