diff --git a/backport-3.9-gh-114572-Fix-locking-in-cert_store_stats-and-ge.patch b/backport-3.9-gh-114572-Fix-locking-in-cert_store_stats-and-ge.patch new file mode 100644 index 0000000000000000000000000000000000000000..0bb632882f63ec86d4f468394bbf0a3da8763855 --- /dev/null +++ b/backport-3.9-gh-114572-Fix-locking-in-cert_store_stats-and-ge.patch @@ -0,0 +1,177 @@ +From b228655c227b2ca298a8ffac44d14ce3d22f6faa Mon Sep 17 00:00:00 2001 +From: Seth Michael Larson +Date: Fri, 10 May 2024 06:46:12 -0500 +Subject: [PATCH] [3.9] gh-114572: Fix locking in cert_store_stats and + get_ca_certs (#118109) + +--- + ...-04-19-11-21-13.gh-issue-114572.t1QMQD.rst | 4 + + Modules/_ssl.c | 91 ++++++++++++++++++- + 2 files changed, 92 insertions(+), 3 deletions(-) + create mode 100644 Misc/NEWS.d/next/Security/2024-04-19-11-21-13.gh-issue-114572.t1QMQD.rst + +diff --git a/Misc/NEWS.d/next/Security/2024-04-19-11-21-13.gh-issue-114572.t1QMQD.rst b/Misc/NEWS.d/next/Security/2024-04-19-11-21-13.gh-issue-114572.t1QMQD.rst +new file mode 100644 +index 0000000000..b4f9fe64db +--- /dev/null ++++ b/Misc/NEWS.d/next/Security/2024-04-19-11-21-13.gh-issue-114572.t1QMQD.rst +@@ -0,0 +1,4 @@ ++:meth:`ssl.SSLContext.cert_store_stats` and ++:meth:`ssl.SSLContext.get_ca_certs` now correctly lock access to the ++certificate store, when the :class:`ssl.SSLContext` is shared across ++multiple threads. +diff --git a/Modules/_ssl.c b/Modules/_ssl.c +index 3f95d3e103..5e0be34d6f 100644 +--- a/Modules/_ssl.c ++++ b/Modules/_ssl.c +@@ -166,6 +166,10 @@ extern const SSL_METHOD *TLSv1_2_method(void); + # define PY_OPENSSL_1_1_API 1 + #endif + ++#if (OPENSSL_VERSION_NUMBER >= 0x30300000L) && !defined(LIBRESSL_VERSION_NUMBER) ++# define OPENSSL_VERSION_3_3 1 ++#endif ++ + /* SNI support (client- and server-side) appeared in OpenSSL 1.0.0 and 0.9.8f + * This includes the SSL_set_SSL_CTX() function. + */ +@@ -210,6 +214,16 @@ extern const SSL_METHOD *TLSv1_2_method(void); + #define HAVE_OPENSSL_CRYPTO_LOCK + #endif + ++/* OpenSSL 1.1+ allows locking X509_STORE, 1.0.2 doesn't. */ ++#ifdef OPENSSL_VERSION_1_1 ++#define HAVE_OPENSSL_X509_STORE_LOCK ++#endif ++ ++/* OpenSSL 3.3 added the X509_STORE_get1_objects API */ ++#ifdef OPENSSL_VERSION_3_3 ++#define HAVE_OPENSSL_X509_STORE_GET1_OBJECTS 1 ++#endif ++ + #if defined(OPENSSL_VERSION_1_1) && !defined(OPENSSL_NO_SSL2) + #define OPENSSL_NO_SSL2 + #endif +@@ -4675,6 +4689,54 @@ set_sni_callback(PySSLContext *self, PyObject *arg, void *c) + #endif + } + ++/* Shim of X509_STORE_get1_objects API from OpenSSL 3.3 ++ * Only available with the X509_STORE_lock() API */ ++#if defined(HAVE_OPENSSL_X509_STORE_LOCK) && !defined(OPENSSL_VERSION_3_3) ++#define HAVE_OPENSSL_X509_STORE_GET1_OBJECTS 1 ++ ++static X509_OBJECT *x509_object_dup(const X509_OBJECT *obj) ++{ ++ int ok; ++ X509_OBJECT *ret = X509_OBJECT_new(); ++ if (ret == NULL) { ++ return NULL; ++ } ++ switch (X509_OBJECT_get_type(obj)) { ++ case X509_LU_X509: ++ ok = X509_OBJECT_set1_X509(ret, X509_OBJECT_get0_X509(obj)); ++ break; ++ case X509_LU_CRL: ++ /* X509_OBJECT_get0_X509_CRL was not const-correct prior to 3.0.*/ ++ ok = X509_OBJECT_set1_X509_CRL( ++ ret, X509_OBJECT_get0_X509_CRL((X509_OBJECT *)obj)); ++ break; ++ default: ++ /* We cannot duplicate unrecognized types in a polyfill, but it is ++ * safe to leave an empty object. The caller will ignore it. */ ++ ok = 1; ++ break; ++ } ++ if (!ok) { ++ X509_OBJECT_free(ret); ++ return NULL; ++ } ++ return ret; ++} ++ ++static STACK_OF(X509_OBJECT) * ++X509_STORE_get1_objects(X509_STORE *store) ++{ ++ STACK_OF(X509_OBJECT) *ret; ++ if (!X509_STORE_lock(store)) { ++ return NULL; ++ } ++ ret = sk_X509_OBJECT_deep_copy(X509_STORE_get0_objects(store), ++ x509_object_dup, X509_OBJECT_free); ++ X509_STORE_unlock(store); ++ return ret; ++} ++#endif ++ + PyDoc_STRVAR(PySSLContext_sni_callback_doc, + "Set a callback that will be called when a server name is provided by the SSL/TLS client in the SNI extension.\n\ + \n\ +@@ -4704,7 +4766,15 @@ _ssl__SSLContext_cert_store_stats_impl(PySSLContext *self) + int x509 = 0, crl = 0, ca = 0, i; + + store = SSL_CTX_get_cert_store(self->ctx); ++#if HAVE_OPENSSL_X509_STORE_GET1_OBJECTS ++ objs = X509_STORE_get1_objects(store); ++ if (objs == NULL) { ++ PyErr_SetString(PyExc_MemoryError, "failed to query cert store"); ++ return NULL; ++ } ++#else + objs = X509_STORE_get0_objects(store); ++#endif + for (i = 0; i < sk_X509_OBJECT_num(objs); i++) { + obj = sk_X509_OBJECT_value(objs, i); + switch (X509_OBJECT_get_type(obj)) { +@@ -4718,12 +4788,13 @@ _ssl__SSLContext_cert_store_stats_impl(PySSLContext *self) + crl++; + break; + default: +- /* Ignore X509_LU_FAIL, X509_LU_RETRY, X509_LU_PKEY. +- * As far as I can tell they are internal states and never +- * stored in a cert store */ ++ /* Ignore unrecognized types. */ + break; + } + } ++#if HAVE_OPENSSL_X509_STORE_GET1_OBJECTS ++ sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free); ++#endif + return Py_BuildValue("{sisisi}", "x509", x509, "crl", crl, + "x509_ca", ca); + } +@@ -4755,7 +4826,15 @@ _ssl__SSLContext_get_ca_certs_impl(PySSLContext *self, int binary_form) + } + + store = SSL_CTX_get_cert_store(self->ctx); ++#if HAVE_OPENSSL_X509_STORE_GET1_OBJECTS ++ objs = X509_STORE_get1_objects(store); ++ if (objs == NULL) { ++ PyErr_SetString(PyExc_MemoryError, "failed to query cert store"); ++ return NULL; ++ } ++#else + objs = X509_STORE_get0_objects(store); ++#endif + for (i = 0; i < sk_X509_OBJECT_num(objs); i++) { + X509_OBJECT *obj; + X509 *cert; +@@ -4783,9 +4862,15 @@ _ssl__SSLContext_get_ca_certs_impl(PySSLContext *self, int binary_form) + } + Py_CLEAR(ci); + } ++#if HAVE_OPENSSL_X509_STORE_GET1_OBJECTS ++ sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free); ++#endif + return rlist; + + error: ++#if HAVE_OPENSSL_X509_STORE_GET1_OBJECTS ++ sk_X509_OBJECT_pop_free(objs, X509_OBJECT_free); ++#endif + Py_XDECREF(ci); + Py_XDECREF(rlist); + return NULL; +-- +2.21.0.windows.1 + diff --git a/python3.spec b/python3.spec index 34be3f34eb1853f4312c7371b5593b4c18ef096e..74d96e7524e03ba916e9a1b6a5c09de0df3c3acb 100644 --- a/python3.spec +++ b/python3.spec @@ -3,7 +3,7 @@ Summary: Interpreter of the Python3 programming language URL: https://www.python.org/ Version: 3.9.9 -Release: 33 +Release: 34 License: Python-2.0 %global branchversion 3.9 @@ -122,6 +122,7 @@ Patch6024: backport-3.9-gh-91133-tempfile.TemporaryDirectory-fix-symlink.patch Patch6025: backport-3.9-gh-109858-Protect-zipfile-from-quoted-overlap-zi.patch Patch6026: backport-3.9-gh-113659-Skip-hidden-.pth-files-GH-113660-GH-11.patch Patch6027: backport-fix_xml_tree_assert_error.patch +Patch6028: backport-3.9-gh-114572-Fix-locking-in-cert_store_stats-and-ge.patch Patch9000: add-the-sm3-method-for-obtaining-the-salt-value.patch Patch9001: python3-Add-sw64-architecture.patch @@ -239,6 +240,7 @@ rm -r Modules/expat %patch6025 -p1 %patch6026 -p1 %patch6027 -p1 +%patch6028 -p1 %patch9000 -p1 %patch9001 -p1 @@ -867,6 +869,12 @@ export BEP_GTDLIST="$BEP_GTDLIST_TMP" %{_mandir}/*/* %changelog +* Web Jul 10 2024 xinsheng - 3.9.9-34 +- Type:bugfix +- CVE:NA +- SUG:NA +- DESC:Fix locking in cert_store_stats and get_ca_certs + * Tue Jun 25 2024 peng.zou - 3.9.9-33 - Type:bugfix - CVE:NA