fix(security): resolve CVE-2026-26007 by migrating deprecated OpenSSL.crypto.verify and unblocking cryptography >= 46.0.5#1021
Conversation
|
@ascii-dev I got your contribution here: thank you |
|
@peppelinux Awesome to see this actively unblocking the v3.2.0 release for iam-proxy-italia! Glad it was helpful. @c00kiemon5ter - let me know if there are any changes you'd like me to add to get this aligned for a merge. |
robin92
left a comment
robin92
left a comment
There was a problem hiding this comment.
I think this is a good change though I'd take care of
issue: cert_crypto.signature_hash_algorithm can return None which would cause a TypeError from _ec.ECDSA call.
and add some tests before merging this.
| "Topic :: Software Development :: Libraries :: Python Modules", | ||
| ] | ||
| requires-python = ">= 3.9" | ||
| requires-python = ">= 3.9.2" |
There was a problem hiding this comment.
suggestion: If there weren't any fixes that you need, then I'd avoid bumping this.
There was a problem hiding this comment.
@robin92 cryptography (46.0.5) requires >=3.8 but explicitly excludes 3.9.0 and 3.9.1.
…ing crypto.verify
ascii-dev
force-pushed
the
bump_openssl_cryptography_versions
branch
from
26f4ca7 to
9377d34
Compare
| "cryptography >=46.0.5", | ||
| "defusedxml", | ||
| "pyopenssl <24.3.0", | ||
| "pyopenssl >=25.3.0", |
There was a problem hiding this comment.
should bump this to >=26.0.0 as well (#1023)
| return False, ("CN may not be equal for CA certificate and the " "signed certificate.") | ||
| ca_cn = ca_cert_crypto.subject.get_attributes_for_oid(_x509.NameOID.COMMON_NAME) | ||
| cert_cn = cert_crypto.subject.get_attributes_for_oid(_x509.NameOID.COMMON_NAME) | ||
| if ca_cn and cert_cn and ca_cn[0].value == cert_cn[0].value: |
There was a problem hiding this comment.
If common name is missing from both certs the old code would return False: pyopenssl returns None if attribute is missing: https://github.com/pyca/pyopenssl/blob/f72218efff8a1e3e7ae4683793ad36d2f9610976/src/OpenSSL/crypto.py#L681
New code will not return in such case.
I don't know if that is a problem or not, just pointing out that there is a subtle difference in logic.
|
We are currently developing a SAML-based SSO implementation using pysaml2. However, we are blocked due to CVE-2026-26007 in the cryptography dependency, which is causing our security/compliance checks to fail. Thanks for all efforts in raising this PR, this change would unblock our adoption and ongoing development. Would appreciate it if this could be reviewed and merged at the earliest. The community is ready to help move this forward. This would also help a broader community currently impacted by this CVE. |
6 participants
Description
The feature or problem addressed by this PR
This PR resolves the dependency deadlock preventing the mitigation of CVE-2026-26007 (elliptic curve subgroup validation vulnerability).
Currently, upgrading the cryptography package to a secure version is blocked by the upper bound constraint on pyopenssl < 24.3.0. That constraint exists because OpenSSL.crypto.verify was deprecated and subsequently removed in pyopenssl 24.3.0. We need a way to verify signatures without relying on the removed API so we can bump both packages and secure downstream users.
Closes #1017
What your changes do and why you chose this solution
To unblock the security patch, this PR refactors the signature verification layer in src/saml2/cert.py.
Technical Changes:
Why this solution:
The project's remaining reliance on pyopenssl for certificate creation and loading remains completely untouched and functional. Existing tests pass locally with xmlsec1 installed.
Checklist