Note: This bug is displayed in read-only format because
the product is no longer active in Red Hat Bugzilla.
RHEL Engineering is moving the tracking of its product development work on RHEL 6 through RHEL 9 to Red Hat Jira (issues.redhat.com). If you're a Red Hat customer, please continue to file support cases via the Red Hat customer portal. If you're not, please head to the "RHEL project" in Red Hat Jira and file new tickets here. Individual Bugzilla bugs in the statuses "NEW", "ASSIGNED", and "POST" are being migrated throughout September 2023. Bugs of Red Hat partners with an assigned Engineering Partner Manager (EPM) are migrated in late September as per pre-agreed dates. Bugs against components "kernel", "kernel-rt", and "kpatch" are only migrated if still in "NEW" or "ASSIGNED". If you cannot log in to RH Jira, please consult article #7032570. That failing, please send an e-mail to the RH Jira admins at rh-issues@redhat.com to troubleshoot your issue as a user management inquiry. The email creates a ServiceNow ticket with Red Hat. Individual Bugzilla bugs that are migrated will be moved to status "CLOSED", resolution "MIGRATED", and set with "MigratedToJIRA" in "Keywords". The link to the successor Jira issue will be found under "Links", have a little "two-footprint" icon next to it, and direct you to the "RHEL project" in Red Hat Jira (issue links are of type "https://issues.redhat.com/browse/RHEL-XXXX", where "X" is a digit). This same link will be available in a blue banner at the top of the page informing you that that bug has been migrated.
DescriptionChristian Heimes
2022-03-01 15:06:24 UTC
Description of problem:
I would like to request a rebase of python-cryptography to 36.0.1 in order to provide compatibility with OpenSSL 3.0 in FIPS mode. I'm aware that my requests comes very late in the RHEL 9 release cycle. My request is motivated by the fact that rebase of our OpenSSL package to 3.0.1 and our downstream FIPS patches have revealed several issues with our build of python-cryptography.
As of today RHEL 9 contains python-cryptography 3.4.7 + a largish patch set for OpenSSL 3.0.0 compatibility. The upstream release 3.4.7 does not have full OpenSSL 3.0.0 compatibility. The patchset contains necessary backports from 35.0 and 36.0 release to make python-cryptography fully OpenSSL 3.0.0 compatibility in non-FIPS mode.
However patchset is not sufficient to use python-cryptography in FIPS mode. OpenSSL 3.0's FIPS mode works differently than OpenSSL 1.1.1. FIPS 140-3 also blocks more algorithms than 140-2. On top of that, C9S and RHEL 9 builds of OpenSSL 3.0 block additional algorithms like 3DES and DSA. An attempt to identify and backport all necessary FIPS changes from 36.0 to 3.4 turned out to be complicated and fragile. Upstream has changed and reworked the code and their test suite a lot between 3.4 and 36.0
Additional info:
Upstream changelog https://cryptography.io/en/latest/changelog/ Note: Upstream changed version scheme. The next major version after 3.4.7 was 35.0
[root@server ~]# rpm -q --changelog python3-cryptography
* Fri Mar 04 2022 Christian Heimes <cheimes> - 36.0.1-6
- Rebase to 36.0.1, related: rhbz#2059630, rhbz#2060787
- OpenSSL 3.0 FIPS mode is now detected correctly, related: rhbz#2054785
- Fix error check from EVP_PKEY_CTX_set_signature_md, related: rhbz#2060343
- Block 3DES in FIPS mode, related: rhbz#2055209
- Disable DSA tests in FIPS mode
- Enable SHA1 signatures in test suite
- Fix serialization of keyusage ext with no bits
- Re-enable tests that are passing again
...
[root@server ~]# rpm -qa python3-cryptography
python3-cryptography-36.0.1-1.el9_0.x86_64
[root@server ~]# cat /etc/redhat-release
Red Hat Enterprise Linux release 9.0 Beta (Plow)
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory (new packages: python-cryptography), and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.
https://access.redhat.com/errata/RHBA-2022:2580