bugbot adjusting priority

CVE-2013-7110

I checked the git and the upstream does not yet have a solution.

Also the package uses bundled urllib3. When I make it use system one it seems to fail properly, but I dunno if it won't stop working somewhere else in the code...

Anyway I commited it to the devel project so if anyone could verify if it is sufficient just create MR from it.

https://build.opensuse.org/package/rdiff/devel:languages:python/transifex-client?linkrev=base&rev=10

My understanding of urllib3 is that this patch probably is not
sufficient. Basically it boild down to:

+    conn = urllib3.connection_from_url(kwargs['hostname'])
+    headers = urllib3.util.make_headers(
+        basic_auth='{0}:{1}'.format(username, password),
+        accept_encoding=True,
+        user_agent=user_agent_identifier(),
+    )

...

+        r = conn.request('GET', url, headers=headers)
+        remote_project = parse_json(r.data)
+        r.close()
+        return remote_project
+    except ssl.SSLError:
+        logger.error("Invalid SSL certificate")
+        raiseconnection_from_url


Stepping down connection_from_url() it looks like you have to pass

a) cert_reqs,

   to force underlying openssl module to check peer certificates
   at all, and

b) ca_certs,

   so openssl module can set the verify-path for the trusted CA-chain.

As both parameters default to None, there is basically no action done
if the peer presents no certificate at all, or it can present you
a X509 certificate signed by anyone (including self-signed),
just the hostname has to match.

(connection_from_url() passes down to HTTPSConnectionPool(), missing
to pass the required above arguments)

So, the answer is: No the patch doesnt work for us :)

Basically I wonder if transiflex-client is really such an important
package. Anyway, by adding cert_reqs parameter to ssl.CERT_REQUIRED
and ca_certs to our system CA-bundle path, it should work.

This is an autogenerated message for OBS integration:
This bug (855579) was mentioned in
https://build.opensuse.org/request/show/226858 Factory / transifex-client

This is an autogenerated message for OBS integration:
This bug (855579) was mentioned in
https://build.opensuse.org/request/show/226885 Factory / transifex-client

I added 0.11.lbeta and submitted it to the factory and based on what upstream says it should really be fixed. So please recheck and close this ;)

Checking the git clone it looks like they are exactly
using connection_from_url() as mentioned in comment#5 which
fixes the issue.