diff options
Diffstat (limited to 'debian/patches/02_require-cert-verification.patch')
| -rw-r--r-- | debian/patches/02_require-cert-verification.patch | 39 |
1 files changed, 39 insertions, 0 deletions
diff --git a/debian/patches/02_require-cert-verification.patch b/debian/patches/02_require-cert-verification.patch new file mode 100644 index 0000000..99f6483 --- /dev/null +++ b/debian/patches/02_require-cert-verification.patch @@ -0,0 +1,39 @@ +From 27ce208c67f4041e8c7e9867236609e522cf06cb Mon Sep 17 00:00:00 2001 +From: Jamie Strandboge <jamie@canonical.com> +Date: Thu, 8 Oct 2015 13:19:47 -0700 +Subject: require SSL certificate validation by default by using + + CERT_REQUIRED and using the system /etc/ssl/certs/ca-certificates.crt +Bug-Ubuntu: https://launchpad.net/bugs/1047054 +Bug-Debian: http://bugs.debian.org/686872 +Last-Update: 2014-09-01 + +Patch-Name: 02_require-cert-verification.patch +--- + urllib3/connectionpool.py | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/urllib3/connectionpool.py b/urllib3/connectionpool.py +index 2204b30..ef60000 100644 +--- a/urllib3/connectionpool.py ++++ b/urllib3/connectionpool.py +@@ -683,6 +683,8 @@ class HTTPSConnectionPool(HTTPConnectionPool): + ``ca_cert_dir``, and ``ssl_version`` are only used if :mod:`ssl` is + available and are fed into :meth:`urllib3.util.ssl_wrap_socket` to upgrade + the connection socket into an SSL socket. ++ ++ On Debian, SSL certificate validation is required by default + """ + + scheme = 'https' +@@ -692,8 +694,8 @@ class HTTPSConnectionPool(HTTPConnectionPool): + strict=False, timeout=Timeout.DEFAULT_TIMEOUT, maxsize=1, + block=False, headers=None, retries=None, + _proxy=None, _proxy_headers=None, +- key_file=None, cert_file=None, cert_reqs=None, +- ca_certs=None, ssl_version=None, ++ key_file=None, cert_file=None, cert_reqs='CERT_REQUIRED', ++ ca_certs='/etc/ssl/certs/ca-certificates.crt', ssl_version=None, + assert_hostname=None, assert_fingerprint=None, + ca_cert_dir=None, **conn_kw): + |