diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index 2bba665d19343e..1adf67e0489cdc 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -1097,6 +1097,15 @@ def test_set_server_sigalgs(self): if CAN_IGNORE_UNKNOWN_OPENSSL_SIGALGS: self.assertIsNone(ctx.set_server_sigalgs('rsa_pss_rsae_sha256:?foo')) + @unittest.skipUnless(CAN_GET_SELECTED_OPENSSL_GROUP, + "SSL library doesn't support getting selected group") + def test_no_session_group_does_not_crash(self): + # Ensure that .group() does not crash because of OpenSSL itself. + # See https://github.com/python/cpython/issues/155782. + ctx = ssl.create_default_context() + obj = ctx.wrap_bio(ssl.MemoryBIO(), ssl.MemoryBIO()) + self.assertIsNone(obj.group()) + def test_options(self): # Test default SSLContext options ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT) diff --git a/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst b/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst new file mode 100644 index 00000000000000..cafa887044fa44 --- /dev/null +++ b/Misc/NEWS.d/next/Library/2026-08-15-11-30-42.gh-issue-155782.JUmDP4.rst @@ -0,0 +1,2 @@ +:mod:`ssl`: prevent a crash in :meth:`~ssl.SSLSocket.group` +for session-less objects on OpenSSL 3.2 and later. Patch by Bénédikt Tran. diff --git a/Modules/_ssl.c b/Modules/_ssl.c index 9f8a6a58cd9327..cdf630f7735e13 100644 --- a/Modules/_ssl.c +++ b/Modules/_ssl.c @@ -2224,7 +2224,9 @@ _ssl__SSLSocket_group_impl(PySSLSocket *self) #if OPENSSL_VERSION_NUMBER >= 0x30200000L const char *group_name; - if (self->ssl == NULL) { + // OpenSSL issue: SSL_get0_group_name(...) crashes if no session exists. + // See https://github.com/openssl/openssl/issues/32379. + if (self->ssl == NULL || SSL_get_session(self->ssl) == NULL) { Py_RETURN_NONE; } group_name = SSL_get0_group_name(self->ssl);