Source: python-urllib3 Version: 1.26.17-1 Severity: normal X-Debbugs-Cc: jdstr...@ubuntu.com, secur...@ubuntu.com
Hi, In the process of packaging a library, I ran into a test failure caused by urllib3's 02_require-cert-verification.patch It looks like this patch is no longer required, but given the security implications, I'm not just going to commit to git, but rather ask for input. Several relevant changes were made in urllib3 since the authoring of this patch: 1. urllib3.contrib.pyopenssl now uses the operating system's default CA certificates on inject. https://github.com/urllib3/urllib3/pull/332 2. When ca_certs is given, cert_reqs defaults to 'CERT_REQUIRED'. https://github.com/urllib3/urllib3/pull/650 With unpatched upstream urllib3 1.26.18 (not even 2.x): >>> import urllib3 >>> http = urllib3.PoolManager() >>> http.request("GET", "https://expired.badssl.com/";) ssl.SSLCertVerificationError: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1006) >>> http.request("GET", "https://wrong.host.badssl.com/";) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='wrong.host.badssl.com', port=443): Max retries exceeded with url: / (Caused by SSLError(CertificateError("hostname 'wrong.host.badssl.com' doesn't match either of '*.badssl.com', 'badssl.com'"))) >>> http.request("GET", "https://untrusted-root.badssl.com/";) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='untrusted-root.badssl.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate in certificate chain (_ssl.c:1006)'))) >>> http.request("GET", "https://self-signed.badssl.com/";) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='self-signed.badssl.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: self-signed certificate (_ssl.c:1006)'))) >>> http.request("GET", "https://revoked.badssl.com/";) urllib3.exceptions.MaxRetryError: HTTPSConnectionPool(host='revoked.badssl.com', port=443): Max retries exceeded with url: / (Caused by SSLError(SSLCertVerificationError(1, '[SSL: CERTIFICATE_VERIFY_FAILED] certificate verify failed: certificate has expired (_ssl.c:1006)'))) How do you feel about dropping it? Stefano
