diff options
| author | Antoine Pitrou <solipsis@pitrou.net> | 2013-05-18 15:59:12 (GMT) |
|---|---|---|
| committer | Antoine Pitrou <solipsis@pitrou.net> | 2013-05-18 15:59:12 (GMT) |
| commit | 31fb419908c63419b4f725e1ad457a9fd0eee526 (patch) | |
| tree | a3c8e3a3bb4823643289d8e4d06d92f97019664d /Lib/test | |
| parent | 1a8c3e247a2c41c1f3a9eceb39bb0e9e5a3d0c6f (diff) | |
| parent | 636f93c63ba286249c1207e3a903f8429efb2041 (diff) | |
| download | cpython-31fb419908c63419b4f725e1ad457a9fd0eee526.zip cpython-31fb419908c63419b4f725e1ad457a9fd0eee526.tar.gz cpython-31fb419908c63419b4f725e1ad457a9fd0eee526.tar.bz2 | |
Issue #17980: Fix possible abuse of ssl.match_hostname() for denial of service using certificates with many wildcards (CVE-2013-2099).
Diffstat (limited to 'Lib/test')
| -rw-r--r-- | Lib/test/test_ssl.py | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/Lib/test/test_ssl.py b/Lib/test/test_ssl.py index d4c90cf..224e0e2 100644 --- a/Lib/test/test_ssl.py +++ b/Lib/test/test_ssl.py @@ -349,6 +349,17 @@ class BasicSocketTests(unittest.TestCase): self.assertRaises(ValueError, ssl.match_hostname, None, 'example.com') self.assertRaises(ValueError, ssl.match_hostname, {}, 'example.com') + # Issue #17980: avoid denials of service by refusing more than one + # wildcard per fragment. + cert = {'subject': ((('commonName', 'a*b.com'),),)} + ok(cert, 'axxb.com') + cert = {'subject': ((('commonName', 'a*b.co*'),),)} + ok(cert, 'axxb.com') + cert = {'subject': ((('commonName', 'a*b*.com'),),)} + with self.assertRaises(ssl.CertificateError) as cm: + ssl.match_hostname(cert, 'axxbxxc.com') + self.assertIn("too many wildcards", str(cm.exception)) + def test_server_side(self): # server_hostname doesn't work for server sockets ctx = ssl.SSLContext(ssl.PROTOCOL_SSLv23) |