Just when you thought it couldn't get worse...
So now the programmer still needs to say OH disable sslv2 (or doesn't
select sslv2) but by default it will be enabled.
The python doc says this:
Selects SSL version 2 or 3 as the channel encryption protocol.
This is a setting to use with servers for maximum compatibility with
the other end of an SSL connection, but it may cause the specific
ciphers chosen for the encryption to be of fairly low quality.
and above this:
Selects SSL version 2 as the channel encryption protocol.
SSL version 2 is insecure. Its use is highly discouraged.
But the default is to use PROTOCOL_SSLv23.
So if looking back at the mercurial source code we have in mercurial/url.py
# avoid using deprecated/broken FakeSocket in python 2.6
_ssl_wrap_socket = ssl.wrap_socket
CERT_REQUIRED = ssl.CERT_REQUIRED
CERT_REQUIRED = 2
and then for some use...
if has_https and self.realhostport: # use CONNECT proxy
self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
# we do not support client x509 certificates
self.sock = _ssl_wrap_socket(self.sock, None, None)
ssl.OP_NO_SSLv2 is now in python 3.2 but it isn't 'on' by default.
"SSL version 2 is considered insecure and is therefore dangerous to
use. If you want maximum compatibility between clients and servers, it
is recommended to use PROTOCOL_SSLv23 as the protocol version and then
disable SSLv2 explicitly using the SSLContext.options attribute:"
"""This class implements a subtype of socket.socket that wraps
the underlying OS socket in an SSL context when necessary, and
provides read and write methods over that channel."""
def __init__(self, sock, keyfile=None, certfile=None,
def wrap_socket(sock, keyfile=None, certfile=None,
def sslwrap_simple(sock, keyfile=None, certfile=None):
"""A replacement for the old socket.ssl function. Designed
for compability with Python 2.5 and earlier. Will disappear in
if hasattr(sock, "_sock"):
sock = sock._sock
ssl_sock = _ssl.sslwrap(sock, 0, keyfile, certfile, CERT_NONE,
There's small choice in rotten apples. -- William Shakespeare, "The
Taming of the Shrew"
Full-Disclosure - We believe in it.
Hosted and sponsored by Secunia - http://secunia.com/