[3.14] gh-160923: Fix fetching with -fips property for usedforsecurity=True (#160984)

Co-authored-by: Bénédikt Tran <10796600+picnixz@users.noreply.github.com>

Author: sethmlarson

Misc/NEWS.d/next/Security/2026-10-29-15-49-06.gh-issue-160923.gCRiZ3.rst

@@ -0,0 +1,5 @@
+.. cve: CVE-2026-119170
+
+Fix fetching with ``-fips`` property for ``usedforsecurity=True``
+in :mod:`hashlib`. This issue only affects Python 3.14.10, and
+all other Python versions are unaffected.

Modules/_hashopenssl.c

@@ -417,10 +417,11 @@ py_digest_by_name(PyObject *module, const char *name, enum Py_hash_type py_ht)
     PY_EVP_MD *digest = NULL, *fresh = NULL;
     _hashlibstate *state = get_hashlib_state(module);
     py_hashentry_t *entry = _Py_hashtable_get(state->hashtable, name);
-    int fips = disable_fips_property(py_ht);
-    if (fips == -1) {
+    int disable_fips = disable_fips_property(py_ht);
+    if (disable_fips == -1) {
         goto finally;
     }
+    int fips = !disable_fips;
 
     if (entry != NULL) {
         PY_EVP_MD **cached = fips ? &entry->evp : &entry->evp_nosecurity;