Bugzilla (bugzilla.redhat.com) will be under maintenance for infrastructure upgrades and will not be available on July 31st between 12:30 AM - 05:30 AM UTC. We appreciate your understanding and patience. You can follow status.redhat.com for details.
Bug 1811170 - Python 3.6 not fully patched for FIPS
Summary: Python 3.6 not fully patched for FIPS
Alias: None
Product: Red Hat Enterprise Linux 8
Classification: Red Hat
Component: python3
Version: 8.2
Hardware: Unspecified
OS: Unspecified
Target Milestone: rc
: ---
Assignee: Python Maintainers
QA Contact: RHEL CS Apps Subsystem QE
Depends On:
TreeView+ depends on / blocked
Reported: 2020-03-06 18:40 UTC by David Davis
Modified: 2020-05-04 17:49 UTC (History)
3 users (show)

Fixed In Version:
Doc Type: If docs needed, set a value
Doc Text:
Clone Of:
Last Closed: 2020-04-14 16:53:10 UTC
Type: Bug
Target Upstream Version:

Attachments (Terms of Use)

Description David Davis 2020-03-06 18:40:01 UTC
I'm on CentOS 7.8 with python3-3.6.8-12.el7.x86_64 which was patched for FIPS (see https://bugzilla.redhat.com/show_bug.cgi?id=1732908). However, I can still call md5 in python3:

>>> import hashlib
>>> m = hashlib.new("md5")
>>> m.update(b"This is a test")
>>> m.digest()

Comment 1 David Davis 2020-03-06 18:43:32 UTC
Sorry, my box is actually CentOS 7.5 but the package version is correct.

I can confirm that FIPS is enabled on the box:

$ cat /proc/sys/crypto/fips_enabled

And python3 does seem to somewhat work as expected:

$ python3
>>> import hashlib
>>> m = hashlib.md5()
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

Note You need to log in before you can comment on or make changes to this bug.