SSL Certificate Identity Verification Bypass in Python

Executive Summary

This vulnerability occurs in Python's ssl.get_server_certificate() function when the ca_certs parameter is provided. The function verifies the certificate chain but does not check if the certificate matches the expected server identity, potentially allowing man-in-the-middle attacks.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, inspect Python scripts using ssl.get_server_certificate() with ca_certs parameter. Check if hostname verification is missing in certificate validation. Review network traffic for unexpected certificate mismatches.

Useful 0 Not Useful 0

Impact Analysis

An attacker could intercept communications by presenting a certificate for a different domain, leading to unauthorized access to sensitive data or impersonation of legitimate servers.

Useful 0 Not Useful 0

Mitigation Strategies

Update Python to versions 3.11 through 3.15 with the latest security patches. Replace ssl.get_server_certificate() with requests or urllib3 libraries that perform proper hostname verification. Audit all scripts using this function.

Useful 0 Not Useful 0