Description of problem: rhbz#2153471 introduced a fix for Bleichenbacher timing attacks. The new feature EVP_PKEY_CTRL_RSA_IMPLICIT_REJECTION breaks an assumption in upstream test case test_decrypt_invalid_decrypt. The test no longer fails with an exception. Version-Release number of selected component (if applicable): 36.0.1-3.el9 How reproducible: always Steps to Reproduce: 1. Run the upstream test suite (spec file runs the test suite in %check) Actual results: =================================== FAILURES =================================== ________________ TestRSADecryption.test_decrypt_invalid_decrypt ________________ self = <tests.hazmat.primitives.test_rsa.TestRSADecryption object at 0x7fa9df2d4730> backend = <OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)> @pytest.mark.supported( only_if=lambda backend: backend.rsa_padding_supported( padding.PKCS1v15() ), skip_message="Does not support PKCS1v1.5.", ) def test_decrypt_invalid_decrypt(self, backend): private_key = RSA_KEY_2048.private_key(backend) with pytest.raises(ValueError): > private_key.decrypt(b"\x00" * 256, padding.PKCS1v15()) E Failed: DID NOT RAISE <class 'ValueError'> tests/hazmat/primitives/test_rsa.py:1562: Failed Expected results: No error Additional info: Issue was detected by OSCI, http://artifacts.osci.redhat.com/baseos-ci/brew-build/52/45/09/52450935/https___baseos-jenkins.rhev-ci-vms.eng.rdu2.redhat.com-ci-artemis/42237/tmpzxfeamhj.01/recipes/1/tasks/4/logs/taskout.log Upstream fix: https://github.com/pyca/cryptography/pull/7895
As per fix test will be marked as skipped. tests/hazmat/primitives/test_rsa.py::TestRSADecryption::test_decrypt_invalid_decrypt SKIPPED =========================== short test summary info ============================ SKIPPED [1600] tests/hazmat/primitives/utils.py:501: Does not support counter location: middle_fixed SKIPPED [1] tests/utils.py:30: Requires OpenSSL without poly1305 support (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Requires backend without RSA OAEP label support (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Does not support PKCS1v1.5. (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Requires FIPS (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [4] tests/hazmat/primitives/test_serialization.py:1919: Requires bcrypt module SKIPPED [1] tests/utils.py:30: Requires that bcrypt exists (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Requires backend support for ec.SECP192R1 (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Does not support SM4 ECB (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Does not support SM4 CBC (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Does not support SM4 OFB (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Does not support SM4 CFB (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Does not support SM4 CTR (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Requires OpenSSL without X25519 support (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) SKIPPED [1] tests/utils.py:30: Requires OpenSSL without X448 support (<OpenSSLBackend(version: OpenSSL 3.0.7 1 Nov 2022, FIPS: False)>) ===================== 1007 passed, 1617 skipped in 41.62s ====================== Based on results marking bug as verified.