Ubuntu
ubuntuone-storage-protocol package

CA Certificate is hardcoded

Bug #925713 reported by Marc Deslauriers
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
Ubuntu One storage protocol
Won't Fix
Undecided
Unassigned
Stable-3-0
Won't Fix
Undecided
Unassigned
Trunk
Won't Fix
Undecided
Unassigned
ubuntuone-storage-protocol (Ubuntu)
Won't Fix
Undecided
Unassigned

Bug Description

CA certificate used to validate server cert is hardcoded in ubuntuone/storageprotocol/context.py.

This should use the system /etc/ssl/certs/ca-certificates.crt file for validation in case the server cert needs to be revoked because it got compromised, or because the CA cert got compromised and revoked.

Tags: foundations+
Marc Deslauriers (mdeslaur)
visibility: private → public
Roman Yepishev (rye)
Changed in ubuntuone-storage-protocol (Ubuntu):
assignee: nobody → Ubuntu One Foundations+ team (ubuntuone-foundations+)
Leo Arias (elopio)
tags: added: foundations+
Marc Deslauriers (mdeslaur)
Changed in ubuntuone-storage-protocol (Ubuntu):
status: New → Confirmed
Revision history for this message
dobey (dobey) wrote :

Because we have to continue shipping the cert .pems anyway, for other platforms, and because OpenSSL has issues with the chaining when reading from ca-certificates.crt, it doesn't seem like trying to get them added to ca-certificates.crt (which seems to have quite a complex process to do), won't affect security at all. And if the cert is changed on the server, validation will fail as-is since the certs would no longer match until we ship an update. Agreed on IRC to just close the bug.

Changed in ubuntuone-storage-protocol:
status: New → Won't Fix
Changed in ubuntuone-storage-protocol (Ubuntu):
status: Confirmed → Won't Fix
assignee: Ubuntu One Foundations+ team (ubuntuone-foundations+) → nobody
security vulnerability: yes → no
Revision history for this message
dobey (dobey) wrote :

Link to IRC log for refrence: http://irclogs.ubuntu.com/2012/03/22/%23ubuntu-desktop.html#t18:42

To post a comment you must log in.
This report contains Public information  
Everyone can see this information.
Subscribing...

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.