[New-bugs-announce] [issue37777] imap breaks on OpenSSL 1.1.1 when SNI is enforced

[Casey]

New submission from Casey <caseylfaist at gmail.com>:

OpenSSL 1.1.1 is an LTS release that will see long maintenance, and Ubuntu 18.04 LTS has now upgraded from 1.1.0 to 1.1.1. However, with this upgrade, TLS 1.3 allows email clients to require an SNI for the handshake to succeed. Because the 2.7 imap module does not enforce or provide SNI to the handshake, Python 2.7 with OpenSSL 1.1.1 will break if an email client requires the SNI hostname.

Relevant 2.7 file:
https://github.com/python/cpython/blob/2.7/Lib/imaplib.py

Right now, the only email client that enforces an SNI header to connect is GMail, and this is why no SSL or imap tests would currently fail due to this issue. This issue was addressed in Python 3.4 but not backported as far as I've been able to tell:

https://github.com/python/cpython/commit/7243b574e5fc6f9ae68dc5ebd8252047b8e78e3b

With a few releases still planned for Python 2.7 before EOL according to Pep 373, while this is not directly a security issue it does block the use of the latest OpenSSL package and seems like a useful inclusion to the last few releases. Happy to submit a backport PR (in progress) if that's likely.

Reproduce steps here: 

https://github.com/CaseyFaist/reproduceSNIcase

----------
assignee: christian.heimes
components: SSL
messages: 349131
nosy: alex, cfactoid, christian.heimes, dstufft, janssen
priority: normal
severity: normal
status: open
title: imap breaks on OpenSSL 1.1.1 when SNI is enforced
type: crash
versions: Python 2.7

_______________________________________
Python tracker <report at bugs.python.org>
<https://bugs.python.org/issue37777>
_______________________________________