Bug 1023742 - ssl.match_hostname(): sub string wildcard should not match IDNA prefix
Summary: ssl.match_hostname(): sub string wildcard should not match IDNA prefix
Keywords:
Status: CLOSED CURRENTRELEASE
Alias: None
Product: Fedora
Classification: Fedora
Component: python3
Version: rawhide
Hardware: Unspecified
OS: Unspecified
unspecified
unspecified
Target Milestone: ---
Assignee: Matej Stuchlik
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard:
Depends On:
Blocks: CVE-2013-7440
TreeView+ depends on / blocked
 
Reported: 2013-10-27 15:00 UTC by Toshio Ernie Kuratomi
Modified: 2016-02-01 02:15 UTC (History)
6 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed: 2013-11-29 10:36:27 UTC
Type: Bug
Embargoed:


Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Python 17997 0 None None None Never

Description Toshio Ernie Kuratomi 2013-10-27 15:00:36 UTC
Description of problem:

http://bugs.python.org/issue17997#msg194950

This was recently fixed upstream and applied to the python3.3.3 and python3.4 branches (neither is released yet.)  There does not appear to be a CVE for this upstream update but there are apparently security implications.

The problem will affect other packages which copy the pair of functions that implement that functionality just like this bug: https://bugzilla.redhat.com/show_bug.cgi?id=963261

As I now have upstream commit rights to fix things like this in python-backports-ssl_match_hostname we should also update packages which copy the code to use the version in the python-backports-ssl_match_hostname package as well.

Something like:

try:
    from backports.ssl_match_hostname import CertificateError, match_hostname
except ImportError:
    CertificateError = None
    match_hostname = None

if not CertificateError:
    # Use the upstream's copied code to define CertificateError

if not match_hostname:
    # Use the upstream's copied code to define match_hostname


Version-Release number of selected component (if applicable):

* All current python3 packages.
* Packages which bundle the applicable code -- an old list is what blocks https://bugzilla.redhat.com/show_bug.cgi?id=963261 there could be new more since then.

Comment 2 Toshio Ernie Kuratomi 2013-10-28 19:54:07 UTC
(In reply to Toshio Ernie Kuratomi from comment #0)
> Something like:
> 
If the upstream code supports python3 as well then the code would be like this:

try:
    # Python3.2+
    from ssl import CertificateError, match_hostname
except ImportError:
    try:
        # backports.ssl_match_hostname from pypi installed
        from backports.ssl_match_hostname import CertificateError, match_hostname
    except ImportError:
        CertificateError = None
        match_hostname = None

if not CertificateError:
    # Use the upstream's copied code to define CertificateError

if not match_hostname:
    # Use the upstream's copied code to define match_hostname

Comment 3 Toshio Ernie Kuratomi 2013-10-28 21:12:09 UTC
Updates for python-setuptools:

* https://admin.fedoraproject.org/updates/python-setuptools-0.9.8-2.fc20 
* (rawhide) http://koji.fedoraproject.org/koji/buildinfo?buildID=474369

Comment 5 Toshio Ernie Kuratomi 2013-12-02 17:02:02 UTC
@security team, any word on what we're going to do with this issue for packages which bundle ssl.match_hostname() ?

Comment 6 Philippe Makowski 2013-12-04 18:45:46 UTC
(In reply to Toshio Ernie Kuratomi from comment #5)
> @security team, any word on what we're going to do with this issue for
> packages which bundle ssl.match_hostname() ?

Just for information and if need , here the list of packages we patched under Mageia :
https://bugs.mageia.org/show_bug.cgi?id=11785#c17
python3-3.3.0-4.5.mga3.src
python-virtualenv-1.10.1-1.2.mga3.src 
python-requests-0.13.5-2.2.mga3.src
bzr-2.5.1-3.2.mga3.src
python-pip-1.3.1-2.2.mga3.src
python-tornado-2.3-2.2.mga3.src
python-urllib3-1.7.1-1.1.mga3.src
python-setuptools-0.9.8-2.2.mga3.src

python-virtualenv is really painfull, we should work with upstream to work on the fact that it is bundling setuptools and pip (https://bugzilla.redhat.com/show_bug.cgi?id=749378)


Note You need to log in before you can comment on or make changes to this bug.