python-httplib2 < 0.7.0 doesn't validate server certificates

[Marc Deslauriers]

python-httplib2 added support for checking https certificates in 0.7.0. The packages currently in Natty and older don't perform any certificate validation, permitting man in the middle attacks on any software that uses the library and doesn't perform checks of it's own.

[Marc Deslauriers (mdeslaur)]

For Oneiric, see bug 882027: it doesn't use the system CA certs by default.

[Marc Deslauriers (mdeslaur)]

SRU team: this isn't an SRU, it's a security update that we've put in -proposed to get more testing. Please let the security team handle this. Thanks.

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-httplib2 - 0.7.2-1ubuntu2~0.10.04.1

---------------
python-httplib2 (0.7.2-1ubuntu2~0.10.04.1) lucid-security; urgency=low

  * SECURITY UPDATE: Incorrect SSL certificate validation (LP: #882030)
    - Backport 0.7.2 as a security update to get proper SSL certificate
      validation support and prevent MITM attacks.
    - debian/control: adjust to work with older dependencies.
    - debian/{control,rules}: get rid of python3 package.
 -- Marc Deslauriers <email address hidden> Mon, 16 Jan 2012 14:07:20 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-httplib2 - 0.7.2-1ubuntu2~0.10.10.1

---------------
python-httplib2 (0.7.2-1ubuntu2~0.10.10.1) maverick-security; urgency=low

  * SECURITY UPDATE: Incorrect SSL certificate validation (LP: #882030)
    - Backport 0.7.2 as a security update to get proper SSL certificate
      validation support and prevent MITM attacks.
    - debian/control: adjust to work with older dependencies.
    - debian/patches/python31-compat.patch: fix compatibility with python3
      version in maverick.
 -- Marc Deslauriers <email address hidden> Mon, 16 Jan 2012 15:32:42 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-httplib2 - 0.7.2-1ubuntu2~0.11.04.1

---------------
python-httplib2 (0.7.2-1ubuntu2~0.11.04.1) natty-security; urgency=low

  * SECURITY UPDATE: Incorrect SSL certificate validation (LP: #882030)
    - Backport 0.7.2 as a security update to get proper SSL certificate
      validation support and prevent MITM attacks.
 -- Marc Deslauriers <email address hidden> Mon, 16 Jan 2012 13:56:37 -0500

[Launchpad Janitor (janitor)]

This bug was fixed in the package python-httplib2 - 0.7.2-1ubuntu2~0.11.10.1

---------------
python-httplib2 (0.7.2-1ubuntu2~0.11.10.1) oneiric-security; urgency=low

  * SECURITY UPDATE: Incorrect SSL certificate validation (LP: #882030)
    - Backport 0.7.2 as a security update to get proper SSL certificate
      validation support and prevent MITM attacks.
 -- Marc Deslauriers <email address hidden> Mon, 16 Jan 2012 13:54:02 -0500