Potential Cryptography Issues in file `libcloud/compute/drivers/vsphere.py`

Aperta
  • Qualcosa non va?
#1,945 2 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
4/5
Tempo stimato
3-5 giorni
Idoneità per principianti
35/100
Tipo di issue
Bug
Chiarezza
Abbastanza chiara
Stato di attività
Ferma
Stack tecnologico
python
Ambito
backend, cloud, security

Direzione di ricerca

Inizia da libcloud/compute/drivers/vsphere.py alle righe indicate 111 e 131-135, quindi esamina i commenti collegati di pyVmomi SoapAdapter e la documentazione di Python ssl. Conferma con i maintainers il comportamento previsto della catena di certificati e la costante del protocollo TLS prima di apportare modifiche; il lavoro è completato quando i due rilievi sono risolti oppure il loro comportamento previsto è chiaramente documentato.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

Summary

This bug report is created by manually analyzing the source codes based on two fixes generated by Intelligent Code Repair tool (iCR).

Detailed Information

  • Python: 3.8.10
  • OS: Ubuntu 20.04

Suggested Fix 1

In your project file libcloud/compute/drivers/vsphere.py on Line 111, there’s a code segment that goes-

context = ssl.create_default_context(cafile=ca_cert)
self.connection = connect.SmartConnect(
    host=host,
    port=port,
    user=username,
    pwd=password,
    sslContext=context,
)

While triaging your repository, we noticed that the connect.SmartConnect method from pyVim library uses a method called Connect that calls a method called __Login which creates a SoapStubAdapter class object. A comment on that class on Line 1380 - 1384 goes-

# @param sslContext SSL Context describing the various SSL options. It is
#                   only supported in Python 2.7.9 or higher.
#            if sslContext is used, load cert & key to the context with API
#            sslContext = ssl.create_default_context(cafile=ca_cert_file)
#            sslContext.load_cert_chain(key_file, cert_file)

However, in your source file the Certificate Chain isn’t loaded into sslContext object. We suggest that you load the certificate chain into the sslContext object as mentioned in the comments.

Suggested Fix 2

In the same file on Line 131 - 135, it goes-

if "certificate verify failed" in error_message:
                # bypass self signed certificates
                try:
                    context = ssl.SSLContext(ssl.PROTOCOL_SSLv23)
                    context.verify_mode = ssl.CERT_NONE

Now, it says here that the following code is to bypass the self-signed certificates. In this case, the official documentation for ssl says-

ssl.PROTOCOL_SSLv23
Alias for PROTOCOL_TLS.
Deprecated since version 3.6: Use PROTOCOL_TLS instead.

To clear the confusion, it’s suggested that you use PROTOCOL_TLS while instantiating the context object. However, if the code is used for some other reason that bypassing self-signed certificates, please let us have a discussion.

CLA Requirements:

This section is only relevant if your project requires contributors to sign a Contributor License Agreement (CLA) for external contributions.

All contributed commits are already automatically signed off.

The meaning of a signoff depends on the project, but it typically certifies that committer has the rights to submit this work under the same license and agrees to a Developer Certificate of Origin (see https://developercertificate.org/ for more information).

Sponsorship and Support

This work is done by the security researchers from OpenRefactory and is supported by the Open Source Security Foundation (OpenSSF): Project Alpha-Omega. Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed - to improve global software supply chain security.

The bug is found by running the iCR tool by OpenRefactory, Inc. and then manually triaging the results.

Lingua principale
Python
Stelle
2.1k
Fork
935
Merge medio
5g 3h
PR unite (30g)
15

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di apache/libcloud

Tutte le issue di apache/libcloud

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.