Bug 976661 - python-webob fails to generate http body md5 hash in fips mode
python-webob fails to generate http body md5 hash in fips mode
Status: CLOSED ERRATA
Product: Red Hat Enterprise Linux 7
Classification: Red Hat
Component: python-webob (Show other bugs)
7.0
Unspecified Unspecified
unspecified Severity unspecified
: rc
: ---
Assigned To: Charalampos Stratakis
Jan Kepler
:
Depends On:
Blocks: 839624 1380359 1393868
  Show dependency treegraph
 
Reported: 2013-06-21 02:48 EDT by Bohuslav "Slavek" Kabrda
Modified: 2017-08-01 13:58 EDT (History)
5 users (show)

See Also:
Fixed In Version: python-webob-1.2.3-7.el7
Doc Type: No Doc Update
Doc Text:
undefined
Story Points: ---
Clone Of:
Environment:
Last Closed: 2017-08-01 13:58:28 EDT
Type: Bug
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Bohuslav "Slavek" Kabrda 2013-06-21 02:48:59 EDT
Since MD5 is used for generating hash of message body, python-webob fails in fips mode when trying to do so. IMHO this could be modified by using "usedforsecurity=False" parameter, since as the standard states, "MIC is good for detecting accidental modification of the entity-body in transit, but is not proof against malicious attacks" [1].

[1] http://www.w3.org/Protocols/rfc2616/rfc2616-sec14.html#sec14.15
Comment 2 Miloslav Trmač 2013-06-21 15:24:01 EDT
(In reply to Bohuslav "Slavek" Kabrda from comment #0)
> Since MD5 is used for generating hash of message body, python-webob fails in
> fips mode when trying to do so. IMHO this could be modified by using
> "usedforsecurity=False" parameter, since as the standard states, "MIC is
> good for detecting accidental modification of the entity-body in transit,
> but is not proof against malicious attacks" [1].

Yes.
Comment 5 Charalampos Stratakis 2017-01-24 08:24:12 EST
So in order to reproduce this issue, a rhel 7 machine with fips mode enabled and python-webob and python-nose installed, is required.

From python-webob sources copy the test_response.py file somewhere to the testing machine (as this file is not installed with the package) and invoke the tests with: nosetests test_response.py

3 tests will fail while in fips mode.

======================================================================
ERROR: test_response.test_response_copy_content_md5
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/nose/case.py", line 197, in runTest
    self.test(*self.arg)
  File "/home/harris/Desktop/test_response.py", line 146, in test_response_copy_content_md5
    res.md5_etag(set_content_md5=True)
  File "/usr/lib/python2.7/site-packages/webob/response.py", line 1000, in md5_etag
    md5_digest = md5(body).digest()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

======================================================================
ERROR: test_response.test_md5_etag
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/nose/case.py", line 197, in runTest
    self.test(*self.arg)
  File "/home/harris/Desktop/test_response.py", line 270, in test_md5_etag
    res.md5_etag()
  File "/usr/lib/python2.7/site-packages/webob/response.py", line 1000, in md5_etag
    md5_digest = md5(body).digest()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

======================================================================
ERROR: test_response.test_md5_etag_set_content_md5
----------------------------------------------------------------------
Traceback (most recent call last):
  File "/usr/lib/python2.7/site-packages/nose/case.py", line 197, in runTest
    self.test(*self.arg)
  File "/home/harris/Desktop/test_response.py", line 280, in test_md5_etag_set_content_md5
    res.md5_etag(body, set_content_md5=True)
  File "/usr/lib/python2.7/site-packages/webob/response.py", line 1000, in md5_etag
    md5_digest = md5(body).digest()
ValueError: error:060800A3:digital envelope routines:EVP_DigestInit_ex:disabled for fips

This can be fixed at the response.py file of webob, by adding the keyword 'usedforsecurity=False' when generating an etag for the response object using an MD5 hash of the body, so the line 'md5_digest = md5(body).digest()' will need to be changed to 'md5_digest = md5(body, usedforsecurity=False).digest()' at the 'def md5_etag' function.
Comment 9 errata-xmlrpc 2017-08-01 13:58:28 EDT
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.

For information on the advisory, and where to find the updated
files, follow the link below.

If the solution does not work for you, open a new bug report.

https://access.redhat.com/errata/RHBA-2017:1890

Note You need to log in before you can comment on or make changes to this bug.