[staging-25.11] python3Packages.pyopenssl: backport 26.0 security fixes

[mweinelt]

Fixes: CVE-2026-27459, CVE-2026-27448

Things done

• Built on platform:
  • x86_64-linux
  • aarch64-linux
  • x86_64-darwin
  • aarch64-darwin
• Tested, as applicable:
  • NixOS tests in nixos/tests.
  • Package tests at passthru.tests.
  • Tests in lib/tests or pkgs/test for functions and "core" functionality.
• Ran nixpkgs-review on this PR. See nixpkgs-review usage.
• Tested basic functionality of all binary files, usually in ./result/bin/.
• Nixpkgs Release Notes
  • Package update: when the change is major or breaking.
• NixOS Release Notes
  • Module addition: when adding a new NixOS module.
  • Module update: when the change is significant.
• Fits CONTRIBUTING.md, pkgs/README.md, maintainers/README.md and other READMEs.

[github-actions]

This report is automatically generated by the PR / Check / cherry-pick CI workflow.

Some of the commits in this PR require the author's and reviewer's attention.

Please follow the backporting guidelines and cherry-pick with the -x flag.
This requires changes to the unstable master and staging branches first, before backporting them.

Occasionally, commits are not cherry-picked at all, for example when updating minor versions of packages which have already advanced to the next major on unstable.
These commits can optionally be marked with a Not-cherry-picked-because: <reason> footer.

If you need to merge this PR despite the warnings, please dismiss this review shortly before merging.

Warning

Couldn't locate the cherry-picked commit's hash in the commit message of b03b950.

Hint: The full diffs are also available in the runner logs with slightly better highlighting.

[vcunat]

ceph uses version 23.1.1 where these patches don't apply. I avoided them in 1100ff6 but who knows about the security implications.

/cc ceph.meta.maintainers: @adevress @alexanderkjeldaas @johanot @krav @nh2 @benaryorg and the staging-next-25.11 PR #507470

[benaryorg]

ceph uses version 23.1.1 where these patches don't apply

According to OpenCVE CVE-2026-27459 applies to >= 22.0.0, < 26.0.0 and CVE-2026-27448 to >= 0.14.0, < 26.0.0 so this might actually be an issue.

26.05 will ship Ceph Tentacle which is back to using the regular nixpkgs versions for all things Python with no vendoring, so this is an issue specifically for 25.11 and the time it remains supported, but nonetheless an issue.
I'll have a go at backporting them, will report back later today.

[benaryorg]

The probability that Ceph actually uses those callbacks is low (though I haven't checked), but actually backporting is more or less trivial.
The changes are very localized and the brunt of the merge conflict comes from the Changelog which we can just not pull in.

Attached is a cherry-pick of the 57f09bb and d41a814 commits onto the 23.1.x branch (which is equivalent to the 23.1.1 tag)
I've tested none of it so far, and it may be woefully superfluous, but actually backporting was easy enough, so vendoring these patches until 25.11 runs out of support may be the path of least resistance.

Feel free to pick this up here, otherwise I'll see if I get around to opening a proper PR tomorrow.