Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Python 3.12 issue with wrap_socket (deprecated in 3.7) #1057

Closed
ekrichbaum opened this issue Nov 21, 2023 · 5 comments
Closed

Python 3.12 issue with wrap_socket (deprecated in 3.7) #1057

ekrichbaum opened this issue Nov 21, 2023 · 5 comments
Labels

Comments

@ekrichbaum
Copy link

Describe the bug

Remove the ssl.wrap_socket() function, deprecated in Python 3.7: instead, create a ssl.SSLContext object and call its ssl.SSLContext.wrap_socket method. Any package that still uses ssl.wrap_socket() is broken and insecure. The function neither sends a SNI TLS extension nor validates server hostname. Code is subject to CWE-295: Improper Certificate Validation. (Contributed by Victor Stinner in gh-94199.)

around line 1002:

   # Function used to wrap sockets with SSL
   contextInstance                 = ssl.SSLContext();
   contextInstance.verify_mode     = ssl.CERT_REQUIRED;
   contextInstance.load_verify_locations(cafile=os.path.relpath(certifi.where()),
       capath=None, cadata=None);
   socketInstance = socket.socket();
   _SocketWrapper = contextInstance.wrap_socket(socketInstance);
   #_SocketWrapper = ssl.wrap_socket

Reproduction steps

  1. Python 3.12
    ...

Expected behavior

Follow >3.7 python guidelines. Do not break in 3.12.

Additional context

No response

@ekrichbaum ekrichbaum added the bug label Nov 21, 2023
@ekrichbaum
Copy link
Author

forgot to add:

import certifi

@samweisgamdschie
Copy link

Same problem here. And please add fix to versions <8.0 as well, if possible 👼

@gquittet
Copy link

Same issue here

@gquittet
Copy link

I tried to update the code base to make it compatible with Python 3.12, but after a clean installation of the project, the tests are failing.
Do I miss something?

I want to be sure that I'm not breaking anything with the update.

@ekrichbaum
Copy link
Author

It's been a while so I'm not sure where this even was in context. I see that I referenced around line 1002 but I wasn't specific enough even for myself there.

I see the wrap_socket function used in the SoapAdapter.py file (but not around that line) and will try to recreate this to see where it was that I adjusted it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

No branches or pull requests

3 participants