New submission from Suphannee: 1. Allowing attempting to match invalid hostname According to domain name specification in RFC 1035, only alphanumeric, dot and hyphen are valid characters in domain name. We observe that the function match_hostname() in Lib/ssl.py allows other special characters (e.g., '=', '&') in hostname when attempting to match with certificate commonName (CN)/subjectAltName DNS. An example would be matching hostname "example.a=.com" with certificate CN/DNS "example.a=.com" or CN/DNS "*.a=.example.com". Ensuring that CN/DNS with invalid characters are rejected, will make the library more robust against attacks that utilize such characters.
2. Matching wildcard in public suffix As noted in section 7.2 of RFC 6125, some wildcard location specifications are not clear. We found that the function allows wildcard over public suffix in certificate as well as allows attempting to match in hostname verification, e.g., matches hostname "google.com" and "example.com" with certificate CN/DNS "*.com". This is not an RFC violation, but we might benefit from implementing the check, for example "*.one_label" is restricted. A better option will be having a list of all TLD's and check against it. Thanks. ---------- assignee: christian.heimes components: SSL messages: 289708 nosy: christian.heimes, ssivakorn priority: normal severity: normal status: open title: Hostname validation in SSL match_hostname() type: enhancement _______________________________________ Python tracker <rep...@bugs.python.org> <http://bugs.python.org/issue29824> _______________________________________ _______________________________________________ Python-bugs-list mailing list Unsubscribe: https://mail.python.org/mailman/options/python-bugs-list/archive%40mail-archive.com
