Add support for IP address SAN fields.

Bug #1788262 reported by Mark Thomas
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
python-urllib3 (Ubuntu)
Fix Released
Undecided
Unassigned
Xenial
Confirmed
Medium
Unassigned

Bug Description

** DRAFT in progress...**

[Impact]
The urllib3 library is not using the alternative name field on a TLS certificate to validate the certificate. The problem has been fixed, and we want to take advantage of the fix in Xenial.

"Initial error that was hit while using requests to query an endpoint by ip with a self signed cert:

requests.exceptions.SSLError: hostname 'XX.XX.XX.XXX' doesn't match either of 'XXXX', 'YYYY', 'ZZZZ'

[Test Case]
TBD

[Regression Potential]
TBD

Fix already found in Bionic and Cosmic without reported issue since then about it nor upstream.

[Other Info]

# Upstream bug:
https://github.com/urllib3/urllib3/issues/258

# Upstream PR:
https://github.com/urllib3/urllib3/pull/922

# Upstream commit :
Add support for IP address SAN fields.
https://github.com/urllib3/urllib3/commit/c74bd70c3a97e30f0560bee9b7fa1bfc767ebf0b

Xenial only is affected, Bionic & Cosmic already has the change:

# Upstream
 git describe --contains c74bd70
 1.18

# Rmadison
 python-urllib3 | 1.13.1-2 | xenial
 ==> python-urllib3 | 1.13.1-2ubuntu0.16.04.1 | xenial-updates
 python-urllib3 | 1.22-1 | bionic
 python-urllib3 | 1.22-1 | cosmic

[Original Description]
Please backport
https://github.com/urllib3/urllib3/commit/c74bd70c3a97e30f0560bee9b7fa1bfc767ebf0b
to urllib3 on xenial.

The urllib3 library is not using the alternative name field on a TLS certificate to validate the certificate. The problem has been fixed, and we want to take advantage of the fix in Xenial.

Earliest version of urllib3 library that incorporates this change: 1.18
Earliest version of requests library that bundles this: 2.12.0 (which is actually using urllib3 1.19)

Tags: sts
Eric Desrochers (slashd)
tags: added: sts
Changed in python-urllib3 (Ubuntu):
status: New → Fix Released
Eric Desrochers (slashd)
description: updated
description: updated
description: updated
Changed in python-urllib3 (Ubuntu Xenial):
importance: Undecided → Medium
status: New → Confirmed
description: updated
summary: - backport request of upstream commit
- c74bd70c3a97e30f0560bee9b7fa1bfc767ebf0b on xenial
+ Add support for IP address SAN fields.
Eric Desrochers (slashd)
description: updated
description: updated
description: updated
description: updated
description: updated
description: updated
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.