[Bug 1969810] [NEW] python 3.10: SSLObject does not raise SSLEOFError on OpenSSL 3

[Launchpad Bug Tracker]

*** This bug is a security vulnerability ***

You have been subscribed to a public security bug by Matthieu Clemenceau (mclemenceau):

>From https://github.com/python/cpython/issues/90471 :

--------

PR bpo-25309 (#25309) changed OpenSSL behavior so that it ignores
unexpected EOFs by default. This was detected by the test suites of both
trio and AnyIO when running on OpenSSL 3.

We worked around the problem by explicitly unsetting the
SSL_OP_IGNORE_UNEXPECTED_EOF flag and then checking if the "strerror"
attribute of SSLError contains the text "UNEXPECTED_EOF_WHILE_READING".

The remedy in the standard library would be twofold:

    Revert the change of enabling SSL_OP_IGNORE_UNEXPECTED_EOF by default
    Handle the condition properly so that SSLEOFError is raised instead of the generic SSLError

As SSLSockets ignore SSLEOFError by default, this fix should work fine
for those too.

--------

There isn't any upstream PR associated with this AFAICT.

** Affects: python3.10 (Ubuntu)
     Importance: High
         Status: Confirmed

** Affects: python3.10 (Ubuntu Jammy)
     Importance: High
         Status: Confirmed


** Tags: fr-2314
-- 
python 3.10: SSLObject does not raise SSLEOFError on OpenSSL 3
https://bugs.launchpad.net/bugs/1969810
You received this bug notification because you are a member of Ubuntu Foundations Bugs, which is subscribed to the bug report.