Path: csiph.com!news.dns-netz.com!news.freedyn.net!aioe.org!bofh.it!news.nic.it!robomod From: Daniele Tricoli Newsgroups: linux.debian.maint.python Subject: Re: python-urllib3 1.25.6 uploaded to experimental (closes CVE-2019-11236) but fails build tests Date: Sun, 27 Oct 2019 16:30:01 +0100 Message-ID: References: X-Mailbox-Line: From debian-python-request@lists.debian.org Sun Oct 27 15:22:39 2019 Old-Return-Path: X-Amavis-Spam-Status: No, score=-11.751 tagged_above=-10000 required=5.3 tests=[BAYES_00=-2, HEADER_FROM_DIFFERENT_DOMAINS=0.249, LDO_WHITELIST=-5, PGPSIGNATURE=-5] autolearn=ham autolearn_force=no X-Policyd-Weight: using cached result; rate: -4.6 X-Greylist: delayed 563 seconds by postgrey-1.36 at bendel; Sun, 27 Oct 2019 15:22:27 UTC MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="ugzicp44ps3n67az" Content-Disposition: inline User-Agent: NeoMutt/20180716 X-Mailing-List: archive/latest/17513 List-ID: List-URL: List-Archive: https://lists.debian.org/msgid-search/20191027151300.wxpij5kweuy6uw6i@mornie Approved: robomod@news.nic.it Lines: 98 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python@lists.debian.org, a69852d4-2690-a93e-5d7d-53538c3b6c5b@debian.org X-Original-Date: Sun, 27 Oct 2019 16:13:00 +0100 X-Original-Message-ID: <20191027151300.wxpij5kweuy6uw6i@mornie> X-Original-References: Xref: csiph.com linux.debian.maint.python:11952 --ugzicp44ps3n67az Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Sun, Oct 13, 2019 at 10:31:31PM +0800, Drew Parsons wrote: > It conditionally works. Using curl, I found that TLSv1_0 or TLSv1_1 will > support a successful connection, but only if the maximum SSL_VERSION is > constrained to TLSv1_0 or TLSv1_1 (e.g. curl -v --tlsv1.1 --tls-max 1.1 > https://pub.orcid.org). Without the max, the connection fails: > $ curl --tlsv1.1 https://pub.orcid.org > curl: (35) error:14094410:SSL routines:ssl3_read_bytes:sslv3 alert handsh= ake > failure >=20 > The urllib3 failure was similar, but I do not know how to set tls-max with > urllib3. I could only find the option with curl. I could set up a custom > HTTPAdapter as suggested at https://requests.readthedocs.io/en/master/use= r/advanced/#example-specific-ssl-version > to set ssl_version=3Dssl.PROTOCOL_TLSv1_1 but the ssl module doesn't have= the > SSLVERSION_MAX_TLSv1_1 value that curl has. I could solve it with pycurl > using c.setopt(pycurl.SSLVERSION, pycurl.SSLVERSION_TLSv1_1 | > pycurl.SSLVERSION_MAX_TLSv1_1) For sure I'm missing something, but why not just set TLS version? I tried the following on both Python2 and Python3: >>> import ssl >>> from urllib3.poolmanager import PoolManager >>> http =3D PoolManager(ssl_version=3Dssl.PROTOCOL_TLSv1) >>> r =3D http.request('GET', 'https://pub.orcid.org') >>> r.status 200 > Evidently the orcid server only supports TLSv1.0 and TLSv1.1 and no higher > (why haven't they activated TLSv1.3 yet?!), while curl and urllib3 without > tls-max first test TLSv1.3 and then quit without cascading downwards once > they receive the TLSv1.3 handshake failure. Which is rather odd behaviour > when I think about it. The whole point of supporting multiple protocol > versions is to try the next available version if the first one doesn't wo= rk. Not an expert here, but I think fallback is not done on purpose due downgra= de attacks: https://en.wikipedia.org/wiki/Downgrade_attack > I had a closer look. The failing tests were in python2 only, coming from > the non-ascii (G=C3=ABrman http://K=C3=B6nigsg=C3=A4=C3=9Fchen.de/stra=C3= =9Fe and Japanese > http://=E3=83=92:=E3=82=AD@=E3=83=92.abc.=E3=83=8B/=E3=83=92?=E3=82=AD#= =E3=83=AF) unicode url tests. So from one perspective > we don't need to worry so much about them, we could just disable them (e.= g. > prepend @onlyPy3 to test_parse_url and test_url_vulnerabilities in > test_util.py). We'll be dropping python2 any way in the near future. >=20 > On the other hand, given the nature of the vulnerabilities and the possib= le > uses of urllib3, it's probably best not to leave python2 untested, > especially since they are known to pass on python2 anyway in the right > conditions. Probably there is some package that should be added to > Build-Depends to enable python2 tests to pass, though I have no idea which > that package might be. Fixed adding python{,3}-idna on B-D. I had to add python3-idna because the same tests were failing also on Python3 when I tested them buinding on DoM. Kind regards, --=20 Daniele Tricoli 'eriol' https://mornie.org --ugzicp44ps3n67az Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEExlrvn+W/jMvW7bAZi69SLA1szt0FAl21s/wACgkQi69SLA1s zt1vGhAA0L64ENEsOgJ+yx1CFUOci8vGirLVZi0ttmpfQ2ySSd2N98BXw4Wa8I7w sbkrFc9Fa11x9nsz7GgWr1zLN4QONmzPtcqlNRQTkAV/EuhFQvEygp5bq4B9Cdpi ABZWkqza7LaZKj/S3obYfB/iMVWUM68eSOQOmj2CLBk5nhn3rAdP1ZLAjJsBPk4u P/pZv6jQTGSlonN0mS16LBs2oP+PqSMemSM53MloThe9oC0tCZLiGGjuV5dl8cEZ XAYwma05kDZxKN/X8hGRCAMIEHDsUi+j82D3Ytr20opHydn8dQhwHL4n2SDAlvn2 6FsHXCojLIuzLxTcJs4NfxNVm8HwAPX0xYOdix9sjNwQyDwK7mjjp2oE6OI8SrlK K8PJQSop6cK45+EZ7Be6SKgaXw5GPk/sOCCHj+nTUfGbN8198cLzjyO26tC6SjMS ToGjU5jt2pQpC2SzsnfBF+sEbfxAUN+IdaywKakZGiFZsADm38aPJP9di3eYW2OJ F41ZOnrpToq3ILFtXXIMVZjB5AkHE3vLp8jCd1C5d58Kuf+d/2BO1ioKdx/uncnP njsCYVmh8srMKeDyhc8oJTQKIExBtJcYVSQjWJh8J2RJwnQ8vdMIVeLsia2vgQ/u zmo+L6A5dAmUQ8vO4mBS2m1dC479JrUC7TwpbvdsIYPzspIArzc= =lCXZ -----END PGP SIGNATURE----- --ugzicp44ps3n67az--