Skip to content

gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() - #158503

Merged
hugovk merged 2 commits into
python:mainfrom
sethmlarson:wrap-bio-parameters
Sep 30, 2026
Merged

gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket()#158503
hugovk merged 2 commits into
python:mainfrom
sethmlarson:wrap-bio-parameters

Conversation

@sethmlarson

@sethmlarson sethmlarson commented Sep 30, 2026 •
edited by bedevere-app Bot
Loading

Copy link
Copy Markdown
Contributor

@sethmlarson @picnixz
pythongh-156793: Validate SSLContext.wrap_bio() parameters like wrap_…
6dc0069 
…socket()

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
@sethmlarson sethmlarson added the type-security A security issue label Sep 30, 2026
@sethmlarson sethmlarson added the needs backport to 3.10 only security fixes label Sep 30, 2026
@sethmlarson sethmlarson added release-blocker topic-SSL needs backport to 3.11 only security fixes needs backport to 3.12 only security fixes needs backport to 3.13 only security fixes needs backport to 3.14 bugs and security fixes needs backport to 3.15 pre-release feature fixes, bugs and security fixes labels Sep 30, 2026
@bedevere-app bedevere-app Bot mentioned this pull request Sep 30, 2026
Closed
@read-the-docs-community

read-the-docs-community Bot commented Sep 30, 2026 •
edited
Loading

Copy link
Copy Markdown

Documentation build overview

📚 cpython-previews | 🛠️ Build #34854436 | 📁 Comparing 490f9df against main (069c74a)

  🔍 Preview build  

4 files changed
± library/asyncio-eventloop.html
± library/asyncio-stream.html
± library/ssl.html
± whatsnew/changelog.html

hugovk
hugovk reviewed Sep 30, 2026
View reviewed changes
Comment thread Misc/NEWS.d/next/Security/2026-09-16-14-05-19.gh-issue-156793.Qa1T5Z.rst Outdated
@hugovk
hugovk enabled auto-merge (squash) September 30, 2026 14:32
@hugovk
hugovk merged commit 1697ea3 into python:main Sep 30, 2026
97 of 99 checks passed
@miss-islington-app

miss-islington-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

Thanks @sethmlarson for the PR, and @hugovk for merging it 🌮🎉.. I'm working now to backport this PR to: 3.10, 3.11, 3.12, 3.13, 3.14, 3.15.
🐍🍒⛏🤖

@miss-islington-app

miss-islington-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @hugovk, I could not cleanly backport this to 3.15 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 1697ea386c707142555d98a1263176bbbc014a96 3.15

@miss-islington-app

miss-islington-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @hugovk, I could not cleanly backport this to 3.12 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 1697ea386c707142555d98a1263176bbbc014a96 3.12

@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158509 is a backport of this pull request to the 3.14 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.14 bugs and security fixes label Sep 30, 2026
@miss-islington-app

miss-islington-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @hugovk, I could not cleanly backport this to 3.11 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 1697ea386c707142555d98a1263176bbbc014a96 3.11

@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158510 is a backport of this pull request to the 3.13 branch.

@miss-islington-app

miss-islington-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

Sorry, @sethmlarson and @hugovk, I could not cleanly backport this to 3.10 due to a conflict.
Please backport using cherry_picker on command line.

cherry_picker 1697ea386c707142555d98a1263176bbbc014a96 3.10

@bedevere-app bedevere-app Bot removed the needs backport to 3.13 only security fixes label Sep 30, 2026
@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158511 is a backport of this pull request to the 3.15 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.15 pre-release feature fixes, bugs and security fixes label Sep 30, 2026
@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158513 is a backport of this pull request to the 3.12 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.12 only security fixes label Sep 30, 2026
@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158516 is a backport of this pull request to the 3.11 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.11 only security fixes label Sep 30, 2026
@sethmlarson
sethmlarson deleted the wrap-bio-parameters branch September 30, 2026 15:57
@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158518 is a backport of this pull request to the 3.10 branch.

@bedevere-app bedevere-app Bot removed the needs backport to 3.10 only security fixes label Sep 30, 2026
hugovk added a commit that referenced this pull request Sep 30, 2026
@hugovk @sethmlarson @picnixz
[3.15] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap…
6413901 
…_socket() (GH-158503) (#158511)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
hugovk added a commit that referenced this pull request Sep 30, 2026
@miss-islington @sethmlarson
@picnixz @hugovk
[3.14] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap…
966bf42 
…_socket() (GH-158503) (#158509)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
hugovk added a commit that referenced this pull request Sep 30, 2026
@miss-islington @sethmlarson
@picnixz @hugovk
[3.13] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap…
f4e43ba 
…_socket() (GH-158503) (#158510)

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Yhg1s added a commit that referenced this pull request Sep 30, 2026
@hugovk @sethmlarson
@picnixz @Yhg1s
[3.12] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap…
869069d 
…_socket() (GH-158503) (#158513)

* [3.12] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (GH-158503)
(cherry picked from commit 1697ea3)

* Raise a DeprecationWarning instead of ValueError

Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Co-authored-by: T. Wouters <thomas@python.org>
@Yhg1s Yhg1s mentioned this pull request Sep 30, 2026
Merged
@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158532 is a backport of this pull request to the 3.11 branch.

@Yhg1s Yhg1s mentioned this pull request Sep 30, 2026
Merged
@bedevere-app

bedevere-app Bot commented Sep 30, 2026

Copy link
Copy Markdown

GH-158533 is a backport of this pull request to the 3.10 branch.

pablogsal pushed a commit that referenced this pull request Oct 1, 2026
@Yhg1s @hugovk
@sethmlarson @picnixz
[3.11] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap…
bdebbf9 
…_socket() (GH-158503) (#158532)

[3.11] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (GH-158503) (GH-158513)

* [3.12] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (GH-158503)
(cherry picked from commit 1697ea3)

* Raise a DeprecationWarning instead of ValueError
(cherry picked from commit 869069d)

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
pablogsal added a commit that referenced this pull request Oct 1, 2026
@Yhg1s @hugovk
@sethmlarson @picnixz @pablogsal
[3.10] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap…
5867d4e 
…_socket() (GH-158503) (#158533)

* [3.10] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (GH-158503) (GH-158513)

* [3.12] gh-156793: Validate SSLContext.wrap_bio() parameters like wrap_socket() (GH-158503)
(cherry picked from commit 1697ea3)

* Raise a DeprecationWarning instead of ValueError
(cherry picked from commit 869069d)

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Co-authored-by: T. Wouters <thomas@python.org>

* gh-156793: Start the SSL handshake in the 3.10 hostname validation tests

---------

Co-authored-by: Hugo van Kemenade <1324225+hugovk@users.noreply.github.com>
Co-authored-by: Seth Larson <seth@python.org>
Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>
Co-authored-by: Pablo Galindo Salgado <pablogsal@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@hugovk hugovk hugovk left review comments
@Yhg1s Yhg1s Yhg1s approved these changes
@gpshead gpshead Awaiting requested review from gpshead gpshead is a code owner
@picnixz picnixz Awaiting requested review from picnixz picnixz is a code owner
@1st1 1st1 Awaiting requested review from 1st1 1st1 is a code owner
@asvetlov asvetlov Awaiting requested review from asvetlov asvetlov is a code owner
@kumaraditya303 kumaraditya303 Awaiting requested review from kumaraditya303 kumaraditya303 is a code owner
@willingc willingc Awaiting requested review from willingc willingc is a code owner

Assignees

@hugovk hugovk

Labels

release-blocker topic-SSL type-security A security issue

Projects

Release and Deferred blockers 🚫
Status: Done

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@sethmlarson @hugovk @Yhg1s