python-openssl seems to used insecure ciphers by default (and sha2 certificates break)
Affects | Status | Importance | Assigned to | Milestone | |
---|---|---|---|---|---|
pyopenssl (Ubuntu) |
New
|
Undecided
|
Unassigned |
Bug Description
Description: Ubuntu 12.04.1 LTS
Release: 12.04
python-openssl:
Installed: 0.12-1ubuntu2.1
Candidate: 0.12-1ubuntu2.1
Version table:
*** 0.12-1ubuntu2.1 0
500 http://
500 http://
100 /var/lib/
0.12-1ubuntu2 0
500 http://
We use 12.04 and Openstack with NoVNC. NoVNC recently broke when we updated our SSL certificates to sha256 from sha1 (the only change). Doing some testing:
#!/usr/bin/env python
import ssl
import socket
listen_sock = socket.
listen_
listen_
conn_sock, _addr = listen_
ssl_sock = ssl.wrap_
^^ This breaks.
#!/usr/bin/env python
import ssl
import socket
listen_sock = socket.
listen_
listen_
conn_sock, _addr = listen_
ciphers = "ECDH+AESGCM:
ssl_sock = ssl.wrap_
^^ This works.
The problem is not isolated to NoVNC (by any means). The python install by default doesn't seem to want to support sha256 SSL certificates without defining the ciphers. Additionally, python seems to degrade to almost the worst possible (and most vulnerable) SSL cipher suite selection unless specifically defined.
Can this be fixed for 12.04 LTS? (Also, feel free to smack me down if I'm wrong somehow, I'm severely sleep deprived this week).
information type: | Private Security → Public |