Merge branch '3.13' into backport-0071fb5-3.13

Author: Yhg1s

Doc/whatsnew/3.13.rst

@@ -2867,3 +2867,18 @@ tarfile
   :func:`~tarfile.TarFile.errorlevel` is zero.
   (Contributed by Matt Prodani and Petr Viktorin in :gh:`112887`
   and :cve:`2025-4435`.)
+
+
+Notable changes in 3.13.18
+==========================
+
+ssl
+---
+
+* The :mod:`ssl` module now rejects TLS certificate chains that contain one
+  of a set of compromised eMudhra intermediate CA certificates.  The affected
+  certificates are identified by their public key, so cross-signed copies that
+  reuse the same key are blocked as well.  It is a defense-in-depth backstop
+  that applies even when an application supplies its own root CA bundle, and
+  regardless of whether the platform trust store has removed trust.
+  (Contributed by Christian Heimes in :gh:`160040` for :cve:`2026-115557`.)

Lib/mimetypes.py

@@ -45,17 +45,23 @@
     "suffix_map", "encodings_map", "types_map", "common_types"
 ]
 
-knownfiles = [
-    "/etc/mime.types",
-    "/etc/httpd/mime.types",                    # Mac OS X
-    "/etc/httpd/conf/mime.types",               # Apache
-    "/etc/apache/mime.types",                   # Apache 1
-    "/etc/apache2/mime.types",                  # Apache 2
-    "/usr/local/etc/httpd/conf/mime.types",
-    "/usr/local/lib/netscape/mime.types",
-    "/usr/local/etc/httpd/conf/mime.types",     # Apache 1.2
-    "/usr/local/etc/mime.types",                # Apache 1.3
-    ]
+if sys.platform == "win32":
+    # The default paths would resolve to the root of the current drive on Windows
+    # (e.g. C:\etc\mime.types), which unprivileged users can usually create.
+    # Only the registry is used by default.
+    knownfiles = []
+else:
+    knownfiles = [
+        "/etc/mime.types",
+        "/etc/httpd/mime.types",                    # Mac OS X
+        "/etc/httpd/conf/mime.types",               # Apache
+        "/etc/apache/mime.types",                   # Apache 1
+        "/etc/apache2/mime.types",                  # Apache 2
+        "/usr/local/etc/httpd/conf/mime.types",
+        "/usr/local/lib/netscape/mime.types",
+        "/usr/local/etc/httpd/conf/mime.types",     # Apache 1.2
+        "/usr/local/etc/mime.types",                # Apache 1.3
+        ]
 
 inited = False
 _db = None

Lib/test/certdata/distrusted.zip

@@ -5,6 +5,7 @@
 import pprint
 import shutil
 import tempfile
+import zipfile
 from subprocess import *
 
 startdate = "20180829142316Z"
@@ -224,6 +225,107 @@ def print_cert(path):
     pprint.pprint(_ssl._test_decode_cert(path))
 
 
+# The distrusted test material (compromised eMudhra CA certs and a leaf signed
+# by them) lives in a password-protected zip so it doesn't trip security
+# scanners that cannot tell internal test fixtures from production secrets and
+# flag any certificate or private key they find.  It is encrypted, not merely
+# zipped, because such scanners read inside plain archives.  The password is
+# fixed, public, and not a secret.
+DISTRUSTED_ZIP = 'distrusted.zip'
+DISTRUSTED_ZIP_DIR = 'distrusted'
+DISTRUSTED_ZIP_CHOSEN_KNIGHT = 'Brave Sir Robin'
+
+# ASN.1 template for the intermediate's compromised key: secp384r1 scalar 4.
+# openssl derives the public key when the SEC1 structure omits it.
+distrusted_key_template = """
+    asn1 = SEQUENCE:eckey
+    [eckey]
+    version = INTEGER:1
+    priv = FORMAT:HEX,OCTETSTRING:{scalar}
+    params = EXPLICIT:0,OID:secp384r1
+    """
+
+
+def make_distrusted_spki_cert():
+    # leaf signed by the distrusted intermediate, chains to the distrusted root
+    print("creating distrusted-SPKI test cert")
+    # The standard library can read but not write encrypted zip files, so we
+    # need the Info-ZIP "zip" command to repackage the archive.
+    if shutil.which('zip') is None:
+        raise SystemExit(
+            f"the 'zip' command is required to write the encrypted {DISTRUSTED_ZIP} "
+            "(the zipfile module cannot create encrypted archives); "
+            "please install Info-ZIP's zip utility"
+        )
+
+    # the root and intermediate are real certs we cannot re-mint; carry them
+    # over from the existing archive
+    pw = DISTRUSTED_ZIP_CHOSEN_KNIGHT.encode()
+    with zipfile.ZipFile(DISTRUSTED_ZIP) as z:
+        root = z.read(DISTRUSTED_ZIP_DIR + '/distrusted_root.pem', pw)
+        intermediate = z.read(DISTRUSTED_ZIP_DIR + '/distrusted_intermediate.pem', pw)
+
+    with tempfile.TemporaryDirectory() as workdir:
+        stage = os.path.join(workdir, DISTRUSTED_ZIP_DIR)
+        os.mkdir(stage)
+        req_file = os.path.join(workdir, 'req.cnf')
+        key_file = os.path.join(workdir, 'leaf.key')
+        csr_file = os.path.join(workdir, 'leaf.csr')
+        cert_file = os.path.join(workdir, 'leaf.pem')
+        cakey_conf = os.path.join(workdir, 'cakey.cnf')
+        cakey_der = os.path.join(workdir, 'cakey.der')
+        cakey_file = os.path.join(workdir, 'cakey.pem')
+
+        inter_file = os.path.join(stage, 'distrusted_intermediate.pem')
+        with open(os.path.join(stage, 'distrusted_root.pem'), 'wb') as f:
+            f.write(root)
+        with open(inter_file, 'wb') as f:
+            f.write(intermediate)
+
+        # recreate the intermediate's key (secp384r1 scalar 4) on the fly
+        with open(cakey_conf, 'w') as f:
+            f.write(distrusted_key_template.format(scalar='00' * 47 + '04'))
+        check_call(['openssl', 'asn1parse', '-genconf', cakey_conf,
+                    '-out', cakey_der, '-noout'])
+        check_call(['openssl', 'pkey', '-in', cakey_der,
+                    '-inform', 'DER', '-out', cakey_file])
+
+        req = req_template.format(
+            hostname='localhost',
+            extra_san='',
+            startdate=startdate,
+            enddate=enddate
+        )
+        with open(req_file, 'w') as f:
+            f.write(req)
+        # ECC leaf to match the ECC intermediate
+        check_call(['openssl', 'req', '-new', '-nodes', '-days', '7000',
+                    '-newkey', 'param:secp384r1.pem', '-keyout', key_file,
+                    '-config', req_file, '-out', csr_file])
+        # sign with the distrusted intermediate, not the test CA
+        check_call(['openssl', 'ca', '-config', req_file,
+                    '-extensions', 'req_x509_extensions_full',
+                    '-cert', inter_file, '-keyfile', cakey_file,
+                    '-out', cert_file, '-outdir', 'cadir',
+                    '-policy', 'policy_anything', '-batch', '-infiles', csr_file])
+        with open(key_file) as f:
+            key = f.read()
+        with open(cert_file) as f:
+            cert = f.read()
+        # server sends leaf + intermediate, client trusts the root
+        with open(os.path.join(stage, 'distrusted_keycert.pem'), 'w') as f:
+            f.write(key)
+            f.write(cert)
+            f.write(intermediate.decode())
+
+        # repackage the encrypted archive (zipfile cannot write encryption)
+        zippath = os.path.join(here, DISTRUSTED_ZIP)
+        if os.path.exists(zippath):
+            os.remove(zippath)
+        check_call(['zip', '-q', '-X', '-P', DISTRUSTED_ZIP_CHOSEN_KNIGHT, '-r',
+                    zippath, DISTRUSTED_ZIP_DIR], cwd=workdir)
+
+
 if __name__ == '__main__':
     os.chdir(here)
     cert, key = make_cert_key('localhost', ext='req_x509_extensions_simple')
@@ -309,6 +411,8 @@ def print_cert(path):
         f.write(key)
         f.write(cert)
 
+    make_distrusted_spki_cert()
+
     unmake_ca()
     print("update Lib/test/test_ssl.py and Lib/test/test_asyncio/utils.py")
     print_cert('keycert.pem')

Lib/test/certdata/make_ssl_certs.py

@@ -115,7 +115,7 @@ def test_strings(self):
             'python import gdb; print(gdb.host_charset())')
 
         encoding = stdout.strip()
-        if stderr or not encoding:
+        if not encoding:
             raise RuntimeError(
                 f'unable to determine the host charset of gdb\n'
                 f'stdout={stdout!r}\n'

Lib/test/test_gdb/test_pretty_print.py

@@ -2743,7 +2743,7 @@ def test_fma_infinities(self):
     @unittest.skipIf(
         sys.platform.startswith(("freebsd", "wasi", "netbsd", "emscripten"))
         or (sys.platform == "android" and platform.machine() == "x86_64")
-        or (support.linked_to_musl() and support.linked_to_musl() < (1, 2, 6)),  # gh-131032
+        or support.linked_to_musl(),  # gh-131032
         f"this platform doesn't implement IEE 754-2008 properly")
     def test_fma_zero_result(self):
         nonnegative_finites = [0.0, 1e-300, 2.3, 1e300]

Lib/test/test_math.py

@@ -195,6 +195,10 @@ def test_init_knownfiles(self):
         mimetypes.init()
         self.assertEqual(guess_file_type("file.test2")[0], "testing/test2")
 
+    @unittest.skipIf(sys.platform == "win32", "non-Windows only")
+    def test_default_knownfiles(self):
+        self.assertIn("/etc/mime.types", knownfiles)
+
     def test_added_types_are_used(self):
         mimetypes.add_type('testing/default-type', '')
         mime_type, _ = mimetypes.guess_type('')
@@ -431,6 +435,9 @@ def test_registry_parsing(self):
         eq(self.db.guess_type("image.jpg"), ("image/jpeg", None))
         eq(self.db.guess_type("image.png"), ("image/png", None))
 
+    def test_default_knownfiles(self):
+        self.assertEqual(knownfiles, [])
+
     @unittest.skipIf(not hasattr(_winapi, "_mimetypes_read_windows_registry"),
                      "read_windows_registry accelerator unavailable")
     def test_registry_accelerator(self):

Lib/test/test_mimetypes.py

@@ -18,7 +18,9 @@
 import socket
 import select
 import struct
+import tempfile
 import time
+import zipfile
 import enum
 import gc
 import http.client
@@ -151,6 +153,19 @@ def data_file(*name):
 LEAF_MISSING_AKI_CERTFILE_HOSTNAME = "example.com"
 LEAF_MISSING_AKI_CA = data_file("leaf-missing-aki.ca.pem")
 
+# gh-160040: a leaf signed by a compromised eMudhra intermediate whose public
+# key is on the _ssl distrusted list. The chain to distrusted_root.pem is
+# otherwise valid.
+# The PEMs live in a password-protected zip so the compromised eMudhra certs
+# don't trip security scanners that cannot tell internal test fixtures from
+# production secrets and flag any certificate or private key they find.  It is
+# encrypted, not merely zipped, because such scanners read inside plain archives.
+# The password is fixed, public, and not a secret; it only keeps the archive
+# from storing the PEMs in the clear.
+DISTRUSTED_SPKI_ZIP = data_file("distrusted.zip")
+DISTRUSTED_SPKI_CHOSEN_KNIGHT = b"Brave Sir Robin"  # not a secret, see comment
+DISTRUSTED_SPKI_HOSTNAME = "localhost"
+
 # Same certificate as pycacert.pem, but without extra text in file
 SIGNING_CA = data_file("capath", "ceff1710.0")
 # cert with all kinds of subject alt names
@@ -2158,6 +2173,28 @@ def test_unwrap(self):
         c_in.write(s_out.read())
         client.unwrap()
 
+    def test_distrusted_spki(self):
+        # gh-160040: the server chain is otherwise valid, but the eMudhra
+        # intermediate's public key is on the _ssl distrusted list, so
+        # verification rejects it.
+        client_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+        server_context = ssl.SSLContext(ssl.PROTOCOL_TLS_SERVER)
+        # the contexts load the PEMs now, so the files are only needed here
+        with tempfile.TemporaryDirectory() as tmpdir:
+            with zipfile.ZipFile(DISTRUSTED_SPKI_ZIP) as z:
+                z.extractall(tmpdir, pwd=DISTRUSTED_SPKI_CHOSEN_KNIGHT)
+            certdir = os.path.join(tmpdir, "distrusted")
+            client_context.load_verify_locations(
+                os.path.join(certdir, "distrusted_root.pem"))
+            server_context.load_cert_chain(
+                os.path.join(certdir, "distrusted_keycert.pem"))
+
+        with self.assertRaises(ssl.SSLCertVerificationError) as cm:
+            connected_bio_pair(client_context, server_context,
+                               DISTRUSTED_SPKI_HOSTNAME)
+        # X509_V_ERR_CERT_REJECTED
+        self.assertEqual(cm.exception.verify_code, 28)
+
     def test_sni_callback_context_released_and_callback_raises(self):
         # Variant of the test below without a HelloRetryRequest: the callback
         # switches the connection to another context, drops the last

Lib/test/test_ssl.py

@@ -3145,7 +3145,7 @@ MODULE__SHA1_DEPS=$(srcdir)/Modules/hashlib.h $(LIBHACL_HEADERS) Modules/_hacl/H
 MODULE__SHA2_DEPS=$(srcdir)/Modules/hashlib.h $(LIBHACL_SHA2_HEADERS) $(LIBHACL_SHA2_A)
 MODULE__SHA3_DEPS=$(srcdir)/Modules/hashlib.h $(LIBHACL_HEADERS) Modules/_hacl/Hacl_Hash_SHA3.h Modules/_hacl/Hacl_Hash_SHA3.c
 MODULE__SOCKET_DEPS=$(srcdir)/Modules/socketmodule.h $(srcdir)/Modules/addrinfo.h $(srcdir)/Modules/getaddrinfo.c $(srcdir)/Modules/getnameinfo.c
-MODULE__SSL_DEPS=$(srcdir)/Modules/_ssl.h $(srcdir)/Modules/_ssl/cert.c $(srcdir)/Modules/_ssl/debughelpers.c $(srcdir)/Modules/_ssl/misc.c $(srcdir)/Modules/_ssl_data_111.h $(srcdir)/Modules/_ssl_data_300.h $(srcdir)/Modules/socketmodule.h
+MODULE__SSL_DEPS=$(srcdir)/Modules/_ssl.h $(srcdir)/Modules/_ssl/cert.c $(srcdir)/Modules/_ssl/debughelpers.c $(srcdir)/Modules/_ssl/misc.c $(srcdir)/Modules/_ssl/distrusted_spki.h $(srcdir)/Modules/_ssl_data_111.h $(srcdir)/Modules/_ssl_data_300.h $(srcdir)/Modules/socketmodule.h
 MODULE__TESTCAPI_DEPS=$(srcdir)/Modules/_testcapi/parts.h $(srcdir)/Modules/_testcapi/util.h
 MODULE__TESTLIMITEDCAPI_DEPS=$(srcdir)/Modules/_testlimitedcapi/testcapi_long.h $(srcdir)/Modules/_testlimitedcapi/parts.h $(srcdir)/Modules/_testlimitedcapi/util.h
 MODULE__TESTINTERNALCAPI_DEPS=$(srcdir)/Modules/_testinternalcapi/parts.h

Makefile.pre.in

@@ -0,0 +1,2 @@
+:mod:`mimetypes` no longer reads the files listed in :data:`mimetypes.knownfiles`
+by default on Windows, and uses only the registry.