~bzr-pqm/bzr/bzr.dev

(jameinel) Fix CVE 2013-2009. Avoid allowing multiple wildcards in a single
SSL cert hostname segment. (Andrew Starr-Bochicchio)

added added

removed removed

400

401

# These two methods were imported from Python 3.2's ssl module

402

403

def _dnsname_to_pat(dn):

403

def _dnsname_to_pat(dn, max_wildcards=1):

404

pats = []

405

for frag in dn.split(r'.'):

406

if frag.count('*') > max_wildcards:

407

# Python Issue #17980: avoid denials of service by refusing more

408

# than one wildcard per fragment. A survery of established

409

# policy among SSL implementations showed it to be a

410

# reasonable choice.

411

raise ValueError(

412

"too many wildcards in certificate DNS name: " + repr(dn))

406

413

if frag == '*':

407

414

# When '*' is a fragment by itself, it matches a non-empty dotless

408

415

# fragment.