Skip to content

Doesn't Validate TLS #140

Open
Open
Doesn't Validate TLS#140

Description

@dstufft
dstufft
opened on Mar 12, 2015

Restkit does not validate TLS which means it's HTTPS handling is broken and insecure.

>>> from restkit import request
>>> r = request("https://tv.eurosport.com/")
>>> r.body_string()
'<HTML><HEAD><TITLE>Error</TITLE></HEAD><BODY>\nAn error occurred while processing your request.<p>\nReference&#32;&#35;102&#46;34e74217&#46;1426170776&#46;e615a32\n</BODY></HTML>\n'

Activity

  1. tdsmith commented on Aug 4, 2015

    @tdsmith
    tdsmith
    on Aug 4, 2015

    This was assigned CVE-2015-2674. http://seclists.org/oss-sec/2015/q1/962

  2. macropin commented on Aug 7, 2015

    @macropin
    macropin
    on Aug 7, 2015

    Since Restkit just wraps the Python ssl socket library, this PEP is relevant https://www.python.org/dev/peps/pep-0476/ (and shows the scope of the issue).

    @dstufft if you pass cert_reqs=ssl.CERT_REQUIRED to the request that will force validation. But as far as I can see there is no way to validate the hostname, so the job's only half done. (server_hostname is not a ssl.wrap_socket argument)

  3. andreasstieger commented on May 26, 2017

    @andreasstieger
    andreasstieger
    on May 26, 2017

    Ping?

  4. carnil commented on Oct 3, 2017

    @carnil
    carnil
    on Oct 3, 2017

    Any news?

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions