Bug 923610 (CVE-2015-2674) - VUL-1: CVE-2015-2674: python-restkit: may not properly validate TLS
Summary: VUL-1: CVE-2015-2674: python-restkit: may not properly validate TLS
Status: RESOLVED INVALID
Alias: CVE-2015-2674
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents (show other bugs)
Version: unspecified
Hardware: Other All
: P4 - Low : Minor
Target Milestone: ---
Assignee: James Oakley
QA Contact: Security Team bot
URL: https://smash.suse.de/issue/114966/
Whiteboard:
Keywords:
Depends on:
Blocks:
 
Reported: 2015-03-23 08:48 UTC by Andreas Stieger
Modified: 2024-05-20 14:15 UTC (History)
1 user (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Andreas Stieger 2015-03-23 08:48:42 UTC 
Via oss-sec http://seclists.org/oss-sec/2015/q1/962

Pythons Restskit does not properly validate TLS
(see https://github.com/benoitc/restkit/issues/140). It appears to simply use
ssl.wrap_socket from the standard library, which does not do any validation
by default. This can be verified by doing:

    >>> from restkit import request
    >>> r = request("https://tv.eurosport.com/";)
    >>> r.body_string()
    '<HTML><HEAD>...'

[..]
As far as we can tell, what you mean is that
https://docs.python.org/2/library/ssl.html says "the default settings
of the ssl module are not necessarily appropriate for your
application" and therefore it was the responsibility of the restkit
developer to handle validation, because the goals of restkit include
completely general access to all https URLs. In other words, it
appears that your position is that it is acceptable for
ssl.wrap_socket to have cert_reqs=CERT_NONE as a default, because this
is fully documented and because there's an easy-to-notice "Warning"
paragraph. This seems reasonable (although potentially controversial).

Use CVE-2015-2674.
Comment 1 Andreas Stieger 2015-03-23 08:50:56 UTC 
openSUSE:13.1           python-restkit  4.2.1
openSUSE:13.2           python-restkit  4.2.2
openSUSE:Factory        python-restkit  4.2.2
Comment 2 Swamp Workflow Management 2015-03-23 23:00:24 UTC 
bugbot adjusting priority
Comment 3 Andreas Stieger 2017-05-26 19:30:14 UTC 
remains unfixed
https://github.com/benoitc/restkit/issues/140