Package: turpial Version: 3.0+dfsg-1 Severity: important Tags: security Dear Maintainer,
when starting turpial, it throws the following warning message on the terminal: /usr/lib/python2.7/dist-packages/urllib3/connectionpool.py:732: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html (This warning will only appear once by default.) InsecureRequestWarning) If it's true that turpial uses this python library in a way that no certificate verification is made, this would expose turpial to the danger of potential man in the middle attacks being unnoticed. According to https://urllib3.readthedocs.org/en/latest/security.html enabling certificate verification is in the duty of the application. The warning is embedded inbetween multiple HTTPS connection messages, so I assume it doesn't have that issue for all requests -- unless its multithreaded and this message indeed appears only upon the very first HTTPS request: INFO:urllib3.connectionpool:Starting new HTTPS connection (1): api.twitter.com INFO:urllib3.connectionpool:Starting new HTTPS connection (1): api.twitter.com INFO:urllib3.connectionpool:Starting new HTTPS connection (1): api.twitter.com INFO:urllib3.connectionpool:Starting new HTTPS connection (1): api.twitter.com INFO:urllib3.connectionpool:Starting new HTTPS connection (1): api.twitter.com /usr/lib/python2.7/dist-packages/urllib3/connectionpool.py:732: InsecureRequestWarning: Unverified HTTPS request is being made. Adding certificate verification is strongly advised. See: https://urllib3.readthedocs.org/en/latest/security.html (This warning will only appear once by default.) InsecureRequestWarning) INFO:urllib3.connectionpool:Starting new HTTPS connection (1): api.twitter.com INFO:urllib3.connectionpool:Starting new HTTPS connection (1): api.twitter.com -- System Information: Debian Release: 8.0 APT prefers unstable APT policy: (990, 'unstable'), (600, 'testing'), (110, 'experimental'), (109, 'buildd-unstable'), (109, 'buildd-experimental') Architecture: amd64 (x86_64) Kernel: Linux 3.19.0-trunk-amd64 (SMP w/4 CPU cores) Locale: LANG=C.UTF-8, LC_CTYPE=C.UTF-8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash Init: systemd (via /run/systemd/system) Versions of packages turpial depends on: ii gstreamer0.10-plugins-base 0.10.36-2 ii python 2.7.9-1 ii python-gst0.10 0.10.22-3 ii python-gtk2 2.24.0-4 ii python-jinja2 2.7.3-1 ii python-libturpial 1.7.0-3 ii python-notify 0.1.1-4 ii python-pkg-resources 5.5.1-1 ii python-qt4 4.11.2+dfsg-1 ii python-webkit 1.1.8-3 turpial recommends no packages. turpial suggests no packages. -- no debconf information -- To UNSUBSCRIBE, email to [email protected] with a subject of "unsubscribe". Trouble? Contact [email protected]
