[Python-checkins] cpython (3.2): Issue #17980: Fix possible abuse of ssl.match_hostname() for denial of service
antoine.pitrou
python-checkins at python.org
Sat May 18 17:59:24 CEST 2013
http://hg.python.org/cpython/rev/b9b521efeba3
changeset: 83826:b9b521efeba3
branch: 3.2
parent: 83739:6255b40c6a61
user: Antoine Pitrou <solipsis at pitrou.net>
date: Sat May 18 17:56:42 2013 +0200
summary:
Issue #17980: Fix possible abuse of ssl.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099).
files:
Lib/ssl.py | 9 ++++++++-
Lib/test/test_ssl.py | 11 +++++++++++
Misc/NEWS | 3 +++
3 files changed, 22 insertions(+), 1 deletions(-)
diff --git a/Lib/ssl.py b/Lib/ssl.py
--- a/Lib/ssl.py
+++ b/Lib/ssl.py
@@ -108,9 +108,16 @@
pass
-def _dnsname_to_pat(dn):
+def _dnsname_to_pat(dn, max_wildcards=1):
pats = []
for frag in dn.split(r'.'):
+ if frag.count('*') > max_wildcards:
+ # Issue #17980: avoid denials of service by refusing more
+ # than one wildcard per fragment. A survery of established
+ # policy among SSL implementations showed it to be a
+ # reasonable choice.
+ raise CertificateError(
+ "too many wildcards in certificate DNS name: " + repr(dn))
if frag == '*':
# When '*' is a fragment by itself, it matches a non-empty dotless
# fragment.
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py
--- a/Lib/test/test_ssl.py
+++ b/Lib/test/test_ssl.py
@@ -326,6 +326,17 @@
self.assertRaises(ValueError, ssl.match_hostname, None, 'example.com')
self.assertRaises(ValueError, ssl.match_hostname, {}, 'example.com')
+ # Issue #17980: avoid denials of service by refusing more than one
+ # wildcard per fragment.
+ cert = {'subject': ((('commonName', 'a*b.com'),),)}
+ ok(cert, 'axxb.com')
+ cert = {'subject': ((('commonName', 'a*b.co*'),),)}
+ ok(cert, 'axxb.com')
+ cert = {'subject': ((('commonName', 'a*b*.com'),),)}
+ with self.assertRaises(ssl.CertificateError) as cm:
+ ssl.match_hostname(cert, 'axxbxxc.com')
+ self.assertIn("too many wildcards", str(cm.exception))
+
def test_server_side(self):
# server_hostname doesn't work for server sockets
ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
diff --git a/Misc/NEWS b/Misc/NEWS
--- a/Misc/NEWS
+++ b/Misc/NEWS
@@ -10,6 +10,9 @@
Library
-------
+- Issue #17980: Fix possible abuse of ssl.match_hostname() for denial of
+ service using certificates with many wildcards (CVE-2013-2099).
+
- Issue #17192: Restore the patch for Issue #11729 and Issue #10309
which were omitted in 3.2.4 when updating the bundled version of
libffi used by ctypes.
--
Repository URL: http://hg.python.org/cpython
More information about the Python-checkins
mailing list