Cryptographic API Misuse Vulnerability

[lialon]

Description:

In the "cryptonice/cryptonice/checkport.py", "cryptonice/cryptonice/gethttp.py" and "cryptonice/cryptonice/pwnedkeys.py", I have identified security vulnerabilities about insecure SSL/TLS Verification and configuration. Bypassing certificate verification or accepting all host names are considered insecure. "ssl._create_unverified_context()" shouldn't be used to create SSL/TLS context.

Location:

https://github.com/F5-Labs/cryptonice/blob/master/cryptonice/pwnedkeys.py#L10

connection = http.client.HTTPSConnection("v1.pwnedkeys.com", 443, timeout=5, context=ssl._create_unverified_context())

https://github.com/F5-Labs/cryptonice/blob/master/cryptonice/gethttp.py#L124

conn = http.client.HTTPSConnection(str_host, int_port, timeout=5, context=ssl._create_unverified_context())

https://github.com/F5-Labs/cryptonice/blob/master/cryptonice/checkport.py#L25

conn = http.client.HTTPSConnection(hostname, port, timeout=3, context=ssl._create_unverified_context())

Reference

• CWE-295: Improper Certificate Validation

Recommendations:

Use a SECURE SSL context with proper verification.