https://github.com/python/cpython/commit/7d9da9208fc3dc126bebca6844dfe312afc43c34 commit: 7d9da9208fc3dc126bebca6844dfe312afc43c34 branch: 3.14 author: Seth Larson <[email protected]> committer: picnixz <[email protected]> date: 2026-11-06T13:26:58Z summary:
[3.14] gh-160923: Fix fetching with `-fips` property for usedforsecurity=True (#160984) Co-authored-by: Bénédikt Tran <[email protected]> files: A Misc/NEWS.d/next/Security/2026-10-29-15-49-06.gh-issue-160923.gCRiZ3.rst M Modules/_hashopenssl.c diff --git a/Misc/NEWS.d/next/Security/2026-10-29-15-49-06.gh-issue-160923.gCRiZ3.rst b/Misc/NEWS.d/next/Security/2026-10-29-15-49-06.gh-issue-160923.gCRiZ3.rst new file mode 100644 index 000000000000000..8fa1bc394f716ee --- /dev/null +++ b/Misc/NEWS.d/next/Security/2026-10-29-15-49-06.gh-issue-160923.gCRiZ3.rst @@ -0,0 +1,5 @@ +.. cve: CVE-2026-119170 + +Fix fetching with ``-fips`` property for ``usedforsecurity=True`` +in :mod:`hashlib`. This issue only affects Python 3.14.10, and +all other Python versions are unaffected. diff --git a/Modules/_hashopenssl.c b/Modules/_hashopenssl.c index 09aa2af173e7e5b..a87c541902c23fb 100644 --- a/Modules/_hashopenssl.c +++ b/Modules/_hashopenssl.c @@ -417,10 +417,11 @@ py_digest_by_name(PyObject *module, const char *name, enum Py_hash_type py_ht) PY_EVP_MD *digest = NULL, *fresh = NULL; _hashlibstate *state = get_hashlib_state(module); py_hashentry_t *entry = _Py_hashtable_get(state->hashtable, name); - int fips = disable_fips_property(py_ht); - if (fips == -1) { + int disable_fips = disable_fips_property(py_ht); + if (disable_fips == -1) { goto finally; } + int fips = !disable_fips; if (entry != NULL) { PY_EVP_MD **cached = fips ? &entry->evp : &entry->evp_nosecurity; _______________________________________________ Python-checkins mailing list -- [email protected] To unsubscribe send an email to [email protected] https://mail.python.org/mailman3//lists/python-checkins.python.org Member address: [email protected]
