Uh oh!
There was an error while loading.Please reload this page.
- Notifications
You must be signed in to change notification settings - Fork32.1k
[3.11] gh-118224: Load default OpenSSL provider for nonsecurity algorithms (GH-118236)#118239
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.
Already on GitHub?Sign in to your account
Uh oh!
There was an error while loading.Please reload this page.
Conversation
… algorithmsWhen OpenSSL is configured to only load "base+fips" providers into theNull library context, md5 might not be available at all. In such casescurrently CPython fallsback to internal hashlib implementation isthere is one - as there might not be if one compiles python with--with-builtin-hashlib-hashes=blake2. With this change "default"provider is attempted to be loaded to access nonsecurity hashes.
Most changes to Pythonrequire a NEWS entry. Add one using theblurb_it web app or theblurb command-line tool. If this change has little impact on Python users, wait for a maintainer to apply the |
This is not fixing a security issue, so it should not be backported to 3.11. |
It is FedRAMP/FIPS compliance by-pass. This issue may allow using md5 without specifying "useforsecurity=False" on systems otherwise configured to be in FIPS-mode only. And is the primary reason why documentation mentions that certain distributions of python remove md5 module altogether. Sure will wait for the main one to be merged. |
Uh oh!
There was an error while loading.Please reload this page.
When OpenSSL is configured to only load "base+fips" providers into the Null library context, md5 might not be available at all. In such cases currently CPython fallsback to internal hashlib implementation is there is one - as there might not be if one compiles python with --with-builtin-hashlib-hashes=blake2. With this change "default" provider is attempted to be loaded to access nonsecurity hashes.