Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

bkpaas-auth not compatible with cryptography 43.0.0+ #189

Closed
narasux opened this issue Oct 12, 2024 · 1 comment · Fixed by #191
Closed

bkpaas-auth not compatible with cryptography 43.0.0+ #189

narasux opened this issue Oct 12, 2024 · 1 comment · Fixed by #191

Comments

@narasux
Copy link
Collaborator

narasux commented Oct 12, 2024

bkpaas-auth sdk 中指定的 cryptography 版本是 *

但是从 43.0.0 版本开始,cryptography 移除了 GetCipherByName 方法,导致 bkpaas-auth 2.1.0 版本 import 时会直接报错

File "....py", line 20, in <module>
    from bkpaas_auth.core.encoder import user_id_encoder
  File "/usr/local/lib/python3.11/site-packages/bkpaas_auth/core/encoder.py", line 5, in <module>
    from cryptography.hazmat.backends.openssl.backend import GetCipherByName, backend
ImportError: cannot import name 'GetCipherByName' from 'cryptography.hazmat.backends.openssl.backend' (/usr/local/lib/python3.11/site-packages/cryptography/hazmat/backends/openssl/backend.py)

注:cryptography 在 43.0.1 中修复了一个中危漏洞:GHSA-h4gh-qq45-vh27

@narasux
Copy link
Collaborator Author

narasux commented Oct 16, 2024

https://cryptography.io/en/latest/changelog/

image

通过继承修改 key_sizes 的可选值的方式,在新版本 cryptography 中行不通(原先的 ARC4 可用)

class _ARC4(algorithms.ARC4):
    key_sizes = frozenset(range(40, 2049, 4))

https://github.com/pyca/cryptography/blob/260a61e796879ecd78dff37410d33bab49cb339d/src/rust/src/backend/cipher_registry.rs#L301

image

@narasux narasux linked a pull request Oct 16, 2024 that will close this issue
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant