Improper Certificate Validation Using poplib
PY025
improper_certificate_validation
CWE-295
⚠️ Warning
The Python class poplib.POP3_SSL by default creates an SSL context that
does not verify the server's certificate if the context parameter is unset or
has a value of None. This means that an attacker can easily impersonate a
legitimate server and fool your application into connecting to it.
If you use poplib.POP3_SSL or stls without a context set, you are
opening your application up to a number of security risks, including:
- Man-in-the-middle attacks
- Session hijacking
- Data theft
Example
import poplib
with poplib.POP3_SSL("domain.org") as pop3:
pop3.user("user")
Remediation
Set the value of the context keyword argument to
ssl.create_default_context() to ensure the connection is fully verified.
import poplib
import ssl
with poplib.POP3_SSL(
"domain.org",
context=ssl.create_default_context(),
) as pop3:
pop3.user("user")
False Positives
In the case of a false positive the rule can be suppressed. Simply add a
trailing or preceding comment line with either the rule ID (PY025) or
rule category name (improper_certificate_validation).
- Using rule ID
- Using category name
fix
import poplib
# suppress: PY025
with poplib.POP3_SSL("domain.org") as pop3:
pop3.user("user")
fix
import poplib
# suppress: improper_certificate_validation
with poplib.POP3_SSL("domain.org") as pop3:
pop3.user("user")