Python 3.12 issue with wrap_socket (deprecated in 3.7)

ekrichbaum commented 8 months ago

Describe the bug

Remove the ssl.wrap_socket() function, deprecated in Python 3.7: instead, create a ssl.SSLContext object and call its ssl.SSLContext.wrap_socket method. Any package that still uses ssl.wrap_socket() is broken and insecure. The function neither sends a SNI TLS extension nor validates server hostname. Code is subject to CWE-295: Improper Certificate Validation. (Contributed by Victor Stinner in gh-94199.)

around line 1002:

   # Function used to wrap sockets with SSL
   contextInstance                 = ssl.SSLContext();
   contextInstance.verify_mode     = ssl.CERT_REQUIRED;
   contextInstance.load_verify_locations(cafile=os.path.relpath(certifi.where()),
       capath=None, cadata=None);
   socketInstance = socket.socket();
   _SocketWrapper = contextInstance.wrap_socket(socketInstance);
   #_SocketWrapper = ssl.wrap_socket

Reproduction steps

Python 3.12 ...

Expected behavior

Follow >3.7 python guidelines. Do not break in 3.12.

Additional context

No response

ekrichbaum commented 8 months ago

forgot to add:

import certifi

samweisgamdschie commented 6 months ago

Same problem here. And please add fix to versions <8.0 as well, if possible :angel:

gquittet commented 6 months ago

Same issue here

gquittet commented 6 months ago

I tried to update the code base to make it compatible with Python 3.12, but after a clean installation of the project, the tests are failing. Do I miss something?

I want to be sure that I'm not breaking anything with the update.

ekrichbaum commented 6 months ago

It's been a while so I'm not sure where this even was in context. I see that I referenced around line 1002 but I wasn't specific enough even for myself there.

I see the wrap_socket function used in the SoapAdapter.py file (but not around that line) and will try to recreate this to see where it was that I adjusted it.

vmware / pyvmomi