You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I ran this library in a FIPS enforced environment and ran into this exception:
lib/python3.10/site-packages/psycopg2_iam/__init__.py", line 43, in _get_bundle_cert
if hashlib.md5(bundle).hexdigest() != self._get_ca_bundle_hash():
ValueError: [digital envelope routines] unsupported
I worked around it by downloading the CA cert myself and providing the sslrootcert option to the library's connection factory so this code path isn't hit.
However it would be good to update the code here to use a more cryptographically secure algorithm (such as sha512). Another way thats cheating a little bit, is to add usedforsecurity=False to the library call - Some details here:
Changed in version 3.9: All hashlib constructors take a keyword-only argument usedforsecurity with default value True. A false value allows the use of insecure and blocked hashing algorithms in restricted environments. False indicates that the hashing algorithm is not used in a security context, e.g. as a non-cryptographic one-way compression function.
Since this is validating a checksum of a file, rather than for a security context
The text was updated successfully, but these errors were encountered:
I ran this library in a FIPS enforced environment and ran into this exception:
I worked around it by downloading the CA cert myself and providing the
sslrootcert
option to the library's connection factory so this code path isn't hit.However it would be good to update the code here to use a more cryptographically secure algorithm (such as sha512). Another way thats cheating a little bit, is to add
usedforsecurity=False
to the library call - Some details here:https://docs.python.org/3/library/hashlib.html
Since this is validating a checksum of a file, rather than for a security context
The text was updated successfully, but these errors were encountered: