CVE-2023-0509 (published 2023-01-26T22:15Z)

Improper Certificate Validation in GitHub repository pyload/pyload prior to 0.5.0b3.dev44.

CVSS v3 base score: 7.4, HIGH (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N)

Weakness information:
cwe_id: CWE-295
cwe_name: Improper Certificate Validation
description: The product does not validate, or incorrectly validates, a certificate.
extended_description: When a certificate is invalid or malicious, it might allow an attacker to spoof a trusted entity by interfering in the communication path between the host and client. The product might connect to a malicious host while believing it is a trusted host, or the product might be deceived into accepting spoofed data that appears to originate from a trusted host.
         

Fix information:
repo_url: https://github.com/pyload/pyload
commit_details: repo_url: https://github.com/pyload/pyload
author: GammaC0de
author_date: 2023-01-26 02:42:31+02:00
msg: enable SSL certificate verification by default, add option to disable it
repository: repo_url: https://github.com/pyload/pyload
repo_name: pyload/pyload
description: The free and open-source Download Manager written in pure Python
repo_language: Python
owner: pyload
file_changes: filename: default.cfg
change_type: ModificationType.MODIFY
diff: @@ -7,6 +7,7 @@ general - "General":
     debug;trace;stack debug_level : "Debug level" = trace
     int min_free_space : "Minimum free space in MiB" = 1024
     bool folder_per_package : "Create folder for each package" = True
+    bool ssl_verify : "Peer's SSL certificate verification" = True
 permission - "Permissions":
     bool change_user : "Change user of running process" = False
     str user : "Username for ownership" = user

programming_language: Haskell
filename: http_request.py
change_type: ModificationType.MODIFY
diff: @@ -103,7 +103,7 @@ class HTTPRequest:
         self.c.setopt(pycurl.NOPROGRESS, 1)
         if hasattr(pycurl, "AUTOREFERER"):
             self.c.setopt(pycurl.AUTOREFERER, 1)
-        self.c.setopt(pycurl.SSL_VERIFYPEER, 0)
+        self.c.setopt(pycurl.SSL_VERIFYPEER, 1)
         self.c.setopt(pycurl.LOW_SPEED_TIME, 60)
         self.c.setopt(pycurl.LOW_SPEED_LIMIT, 5)
         if hasattr(pycurl, "USE_SSL"):
@@ -114,7 +114,7 @@ class HTTPRequest:
 
         self.c.setopt(
             pycurl.USERAGENT,
-            b"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36",
+            b"Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/109.0",
         )
         if pycurl.version_info()[7]:
             self.c.setopt(pycurl.ENCODING, b"gzip, deflate")
@@ -174,6 +174,9 @@ class HTTPRequest:
         if "timeout" in options:
             self.c.setopt(pycurl.LOW_SPEED_TIME, int(options["timeout"]))
 
+        if "ssl_verify" in options:
+            self.c.setopt(pycurl.SSL_VERIFYPEER, 1 if options["ssl_verify"] else 0)
+
     def add_cookies(self):
         """
         put cookies from curl handle to cj.

programming_language: Python
filename: request_factory.py
change_type: ModificationType.MODIFY
diff: @@ -112,6 +112,7 @@ class RequestFactory:
             "interface": self.iface(),
             "proxies": self.get_proxies(),
             "ipv6": self.pyload.config.get("download", "ipv6"),
+            "ssl_verify": self.pyload.config.get("general", "ssl_verify"),
         }
 
     def update_bucket(self):

programming_language: Python