ansible/ansible — pull request #3835 by mvo5 (2013-08-13 15:45:49+00:00)
Title: use pycurl instead of urllib2 to get cert validation

The new apt_repository module is using urllib2 to get the signing key of a PPA from launchpad. The problem with this approach is that urrlib2 will not do certificate verification, see the warning on the urllib2 documentation:
"""Warning: HTTPS requests do not do any verification of the server’s certificate."""

There was a similar bug about 1.5 years ago in software-properties, see https://bugs.launchpad.net/ubuntu/+source/software-properties/+bug/915210 or CVE-2011-4407.

The attached branch should fix this problem.

Thanks,
Michael

P.S. I noticed that there is a custom SourcesList class - is there anything in the python-apt class that makes it unsuitable to use?