[Bug 2072974] Re: python3-paramiko is unusable on Jammy in FIPS mode

Fri Oct 25 07:21:26 UTC 2024

Hello Adam, or anyone else affected,

Accepted paramiko into noble-proposed. The package will build now and be
available at
https://launchpad.net/ubuntu/+source/paramiko/2.12.0-2ubuntu4.1 in a few
hours, and then in the -proposed repository.

Please help us by testing this new package.  See
https://wiki.ubuntu.com/Testing/EnableProposed for documentation on how
to enable and use -proposed.  Your feedback will aid us getting this
update out to other Ubuntu users.

If this package fixes the bug for you, please add a comment to this bug,
mentioning the version of the package you tested, what testing has been
performed on the package and change the tag from verification-needed-
noble to verification-done-noble. If it does not fix the bug for you,
please add a comment stating that, and change the tag to verification-
failed-noble. In either case, without details of your testing we will
not be able to proceed.

Further information regarding the verification process can be found at
https://wiki.ubuntu.com/QATeam/PerformingSRUVerification .  Thank you in
advance for helping!

N.B. The updated package will be released to -updates after the bug(s)
fixed by this package have been verified and the package has been in
-proposed for a minimum of 7 days.

** Changed in: paramiko (Ubuntu Noble)
       Status: In Progress => Fix Committed

** Tags added: verification-needed verification-needed-noble

** Changed in: paramiko (Ubuntu Jammy)
       Status: In Progress => Fix Committed

** Tags added: verification-needed-jammy

-- 
You received this bug notification because you are a member of Ubuntu
Foundations Bugs, which is subscribed to paramiko in Ubuntu.
https://bugs.launchpad.net/bugs/2072974

Title:
  python3-paramiko is unusable on Jammy in FIPS mode

Status in paramiko package in Ubuntu:
  Confirmed
Status in paramiko source package in Jammy:
  Fix Committed
Status in paramiko source package in Noble:
  Fix Committed

Bug description:
  [ Impact ]
  * When one enables FIPS mode on a Jammy system and then attempts to use paramiko in Python, the module crashes.

  * The cryptography package throws an InternalError when it finds that X25519 is
  unsupported. This error is not being caught and is crashing the import of the
  paramiko package. The fix is to catch the InternalError exception and return
  false that X25519 is not supported.

  [ Test Plan ]

  * Enable FIPS on a Jammy system.
    - sudo pro attach <token>
    - sudo pro enable fips-preview # Non-preview not supported yet?
    - sudo reboot
  (To test FIPS on a Noble system)
    - sudo add-apt-repository ppa:fips-cc-stig/fips-under-certification
    - sudo apt install -y ubuntu-fips openssh-server=1:9.6p1-3ubuntu13+Fips1~rc0 \
          openssh-client=1:9.6p1-3ubuntu13+Fips1~rc0 \
          openssh-sftp-server=1:9.6p1-3ubuntu13+Fips1~rc0 \
          --allow-downgrades --yes
  * Run the Python3 interpreter.
  * Import paramiko and observe the crash.
  * Close the Python3 interpreter.
  * Upgrade to the new version of Paramiko.
  * Run the Python3 interpreter.
  * Import paramiko and observe no crash.
  * FIPS is not available on Oracular, however the bug should be fixed in Oracular and all future versions

  [ Where problems could occur ]

  * If any code relies on that InternalError occurring when checking if X25519 is available, this code will now not work properly because the function will return
  false instead of throwing the InternalError.

  [ Other Info ]

  This is really only needed on systems where FIPS is supported, i.e.
  LTS. In particular, it is not necessary to include in oracular at this
  point, as it would need to be an SRU. It should be fixed once 25.04 is
  opened.

  Hello! When one enables FIPS mode on a Jammy system and then attempts
  to use paramiko in Python, the module crashes with the following
  output:

  ---
      root at jipster:~# cat /proc/sys/crypto/fips_enabled
      1
      root at jipster:~# python3
      Python 3.10.12 (main, Nov 20 2023, 15:14:05) [GCC 11.4.0] on linux
      Type "help", "copyright", "credits" or "license" for more information.
      >>> import paramiko
      Traceback (most recent call last):
        File "<stdin>", line 1, in <module>
        File "/usr/lib/python3/dist-packages/paramiko/__init__.py", line 22, in <module>
          from paramiko.transport import SecurityOptions, Transport
        File "/usr/lib/python3/dist-packages/paramiko/transport.py", line 133, in <module>
          class Transport(threading.Thread, ClosingContextManager):
        File "/usr/lib/python3/dist-packages/paramiko/transport.py", line 208, in Transport
          if KexCurve25519.is_available():
        File "/usr/lib/python3/dist-packages/paramiko/kex_curve25519.py", line 30, in is_available
          X25519PrivateKey.generate()
        File "/usr/lib/python3/dist-packages/cryptography/hazmat/primitives/asymmetric/x25519.py", line 46, in generate
          return backend.x25519_generate_key()
        File "/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/backend.py", line 2317, in x25519_generate_key
          evp_pkey = self._evp_pkey_keygen_gc(self._lib.NID_X25519)
        File "/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/backend.py", line 2305, in _evp_pkey_keygen_gc
          self.openssl_assert(evp_pkey_ctx != self._ffi.NULL)
        File "/usr/lib/python3/dist-packages/cryptography/hazmat/backends/openssl/backend.py", line 242, in openssl_assert
          return binding._openssl_assert(self._lib, ok, errors=errors)
        File "/usr/lib/python3/dist-packages/cryptography/hazmat/bindings/openssl/binding.py", line 77, in _openssl_assert
          raise InternalError(
      cryptography.exceptions.InternalError: Unknown OpenSSL error. This error is commonly encountered when another library is not cleaning up the OpenSSL error stack. If you are using cryptography with another library that uses OpenSSL try disabling it before reporting a bug. Otherwise please file an issue at https://github.com/pyca/cryptography/issues with information on how to reproduce this. ([_OpenSSLErrorWithText(code=50856204, lib=6, reason=524556, reason_text=b'error:0308010C:digital envelope routines::unsupported')])
  ---

  In the above trace, it appears to be attempting to generate an x25519
  key, which isn't an acceptable alg's in FIPS 140-3 and thus fails to
  work.

  1. root at jipster:~# lsb_release -rd
  Description:	Ubuntu 22.04.4 LTS
  Release:	22.04

  2. root at jipster:~# apt-cache policy python3-paramiko
  python3-paramiko:
    Installed: 2.9.3-0ubuntu1.2
    Candidate: 2.9.3-0ubuntu1.2

  3. Expect that one can import the paramiko module successfully for use
  4. Module crashes when (presumably) it attempts to use disallowed alg

To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/paramiko/+bug/2072974/+subscriptions