➜

This issue tracker has been migrated to GitHub, and is currently read-only.
For more information, see the GitHub FAQs in the Python's Developer Guide.

classification
Title: distutils should check PyPI certs when connecting to it
Type: security Stage:
Components: Library (Lib) Versions: Python 3.2, Python 3.3, Python 3.4, Python 2.7
process
Status: closed Resolution: fixed
Dependencies: Superseder:
Assigned To: Nosy List: Giovanni.Bajo, alexis, benjamin.peterson, christian.heimes, cvrebert, dstufft, eric.araujo, georg.brandl, jwilk, pitrou, tiwilliam
Priority: high Keywords:

Created on 2013-12-22 00:52 by pitrou, last changed 2022-04-11 14:57 by admin. This issue is now closed.

Messages (2)
msg206800 - (view) Author: Antoine Pitrou (pitrou) * (Python committer) Date: 2013-12-22 00:52 
Spun off from #12226: distutils now uses HTTPS by default to connect PyPI, but certs aren't checked at all.
msg275222 - (view) Author: Christian Heimes (christian.heimes) * (Python committer) Date: 2016-09-08 23:59 
distutils uses urlopen() which uses ssl.create_default_context() to create a SSLContext with cert validation and hostname verification enabled.
History
Date User Action Args
2022-04-11 14:57:55adminsetgithub: 64249
2016-09-08 23:59:45christian.heimessetstatus: open -> closed
resolution: fixed
messages: + msg275222
2014-04-25 22:22:37tiwilliamsetnosy: + tiwilliam
2014-01-02 12:41:40jwilksetnosy: + jwilk
2013-12-27 18:16:16cvrebertsetnosy: + cvrebert
2013-12-22 00:52:05pitroucreate