FazBrowse GitHub Viewer | Trending |
URL:
| Home
Tools: [Download Repo ZIP]   [Original HTTPS Page]

gh-94199: Remove the ssl.wrap_socket() function by vstinner · Pull Request #94203 · python/cpython · GitHub

  1. python
  2. cpython

Repository navigation

gh-94199: Remove the ssl.wrap_socket() function - #94203

Merged
vstinner merged 1 commit into
python:mainfrom
vstinner:ssl_wrap_socket
Jul 8, 2022
ConversationCommits (1)ChecksFiles changed
Merged

gh-94199: Remove the ssl.wrap_socket() function#94203
vstinner merged 1 commit into
python:mainfrom
vstinner:ssl_wrap_socket

Conversation

vstinner commented Jun 24, 2022 •
edited by bedevere-bot
Loading

Copy link
Copy Markdown
Member

Remove the ssl.wrap_socket() function, deprecated in Python 3.7:
instead, create a ssl.SSLContext object and call its
SSLContext.wrap_socket() method.

vstinner marked this pull request as ready for review June 24, 2022 08:41

vstinner commented Jun 24, 2022

Copy link
Copy Markdown
Member Author

I'm not sure of the Python ecosystem is ready for this :-(

A code search for ssl.wrap_socket in PyPI top 5000 projects (at 2022-01-26) found 355 matching lines in 81 projects:

  • aliyun-python-sdk-core-2.13.35
  • amqp-5.0.9
  • ansible-5.2.0
  • asyncio-3.4.3
  • awscrt-0.13.0
  • AWSIoTPythonSDK-1.4.9
  • backports.ssl_match_hostname-3.7.0.1
  • bandit-1.7.2
  • boto-2.49.0
  • cassandra-driver-3.25.0
  • cbapi-1.7.6
  • clickhouse-driver-0.2.2
  • createsend-6.1.2
  • customerio-1.4
  • distlib-0.3.4.zip
  • distribute-0.7.3.zip
  • Django-4.0.1
  • eventlet-0.33.0
  • future-0.18.2
  • gevent-21.12.0
  • geventhttpclient-1.5.3
  • geventhttpclient-wheels-1.3.1.dev3
  • graypy-2.1.0
  • gsutil-5.6
  • gunicorn-20.1.0
  • heroku3-5.1.4
  • httplib2-0.20.2
  • httpretty-1.1.4
  • hyper-0.7.0
  • IMAPClient-2.2.0.zip
  • impacket-0.9.24
  • launchdarkly-server-sdk-7.3.0
  • ldap3-2.9.1
  • mercurial-6.0.1
  • mysql-connector-2.2.9
  • mysql-connector-python-rf-2.2.2
  • newrelic-7.4.0.172
  • oci-2.55.0
  • oslo.messaging-12.11.1
  • oslo.service-2.8.0
  • pex-2.1.65
  • pg8000-1.23.0
  • pika-1.2.0
  • pip-21.3.1
  • pipenv-2022.1.8
  • pycurl-7.44.1
  • pyeapi-0.8.4
  • pyftpdlib-1.5.6
  • pygelf-0.4.2
  • pykafka-2.8.0
  • PyKMIP-0.10.0
  • pylint-2.12.2
  • pylogbeat-2.0.0
  • python-glanceclient-3.5.0
  • python-magnumclient-3.5.0
  • python-telegram-bot-13.10
  • pyvmomi-7.0.3
  • py-zabbix-1.1.7
  • rabbitpy-2.0.1
  • raven-6.10.0
  • rethinkdb-2.4.8
  • salt-3004
  • secure-smtplib-0.1.1
  • snowflake-connector-python-2.7.3
  • speedtest-cli-2.1.3
  • splunk-sdk-1.6.18
  • sqreen-1.27.4
  • stem-1.8.0
  • stomp.py-7.0.0
  • superlance-2.0.0
  • thrift-0.15.0
  • thriftpy-0.3.9
  • thriftpy2-0.4.14
  • tornado-6.1
  • urllib3-1.26.8
  • uvloop-0.16.0
  • vertica-python-1.0.3
  • wincertstore-0.2.1.zip
  • ws4py-0.5.1
  • youtube_dl-2021.12.17
  • yt-dlp-2022.1.21

vstinner marked this pull request as draft June 24, 2022 08:51
vstinner mentioned this pull request Jun 24, 2022
Closed

tiran commented Jul 8, 2022

Copy link
Copy Markdown
Member

ssl.wrap_socket() has been deprecated and documented as insecure since 3.7 (released 2018).

Any package] that still uses ssl.wrap_socket() is broken and insecure. The function neither sends a SNI TLS extension nor validates server hostname. Code is subject to CWE-295: Improper Certificate Validation and worth a CVE with at least medium severity.

gh-94199: Remove the ssl.wrap_socket() function
d09f060 
Remove the ssl.wrap_socket() function, deprecated in Python 3.7:
instead, create a ssl.SSLContext object and call its
sl.SSLContext.wrap_socket() method. Any package that still uses
ssl.wrap_socket() is broken and insecure. The function neither sends
a SNI TLS extension nor validates server hostname. Code is subject to
CWE-295 : Improper Certificate Validation.

vstinner commented Jul 8, 2022

Copy link
Copy Markdown
Member Author

Any package] that still uses ssl.wrap_socket() is broken and insecure. The function neither sends a SNI TLS extension nor validates server hostname. Code is subject to CWE-295: Improper Certificate Validation and worth a CVE with at least medium severity.

Oh wow, that sounds scary! I updated the documentation to mention that! But I omitted the last part: "and worth a CVE with at least medium severity". I prefer to not say that in the Python documentation.

vstinner marked this pull request as ready for review July 8, 2022 13:19
vstinner merged commit 00464bb into python:main Jul 8, 2022
vstinner deleted the ssl_wrap_socket branch July 8, 2022 13:20

vstinner commented Jul 8, 2022

Copy link
Copy Markdown
Member Author

Merged. Thanks for the review @tiran.

shreya1312 mentioned this pull request Jul 23, 2022
Closed
Ousret mentioned this pull request Nov 5, 2022
Closed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters. Learn more about bidirectional Unicode characters
Show hidden characters
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

tiran tiran approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

Back | FazBrowse Home | New Git URL