Description of problem: UBI8 image ships with an older python-cryptography. Needs updating to cryptography 39.0.0 or greater. Version-Release number of selected component (if applicable): 3.3.1 How reproducible: - Simply use the UBI8 image and install package python39-cryptography. Steps to Reproduce: 1. Create docker image from UBI8 (ex. FROM registry.access.redhat.com/ubi8/ubi-minimal) 2. dnf install python39-cryptography 3. grep -r -H "unsafe_skip_rsa_key_validation" /usr/lib64/python3.9/site-packages/cryptography Actual results: No grep results since "unsafe_skip_rsa_key_validation" became available in cryptography 39.0.0 Expected results: grep results - hazmat/primitives/asymmetric/rsa.py: unsafe_skip_rsa_key_validation: bool = False, hazmat/primitives/asymmetric/rsa.py: self, unsafe_skip_rsa_key_validation ...etc... Additional info:
Could you please elaborate why you are considering the absence of "unsafe_skip_rsa_key_validation" a problem for FIPS-140 compliance? The unsafe_skip_rsa_key_validation option is a dangerous feature that should NEVER be used in production code, unless the caller is absolutely certain the key is coming from a trusted source. The option bypasses important sanity checks of RSA private keys. A malformed or malicious RSA key can and will break RSA algorithm. I would argue that the use of the option in FIPS mode is in violation of FIPS standards.