SSL certificate verification disabled in openframeworks/openframeworks


Reported on

Mar 10th 2022


This report is strange, partially because the existence of this code has been acknowledged without any alarm about its security implication(s), and also because a pull request that would fix the vulnerability (opened as a bug patch) has been open for over two years! Having SSL certificate verification disabled is usually a bad idea because it opens users (in this case, developers' projects) to the availability of man-in-the-middle attacks that utilize self-signed SSL certificates as a way to 'spoof' a secure connection.


This vulnerability is capable of allowing attackers to intercept data sent over HTTPS connections that are handled by the ofURLFileLoaderImpl::handleRequest function.


Context: ofHttpResponse ofURLFileLoaderImpl::handleRequest(const ofHttpRequest & request)

curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0);
curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0);
We are processing your report and will contact the openframeworks team within 24 hours. a year ago
We created a GitHub Issue asking the maintainers to create a a year ago
We have contacted a member of the openframeworks team and are waiting to hear back a year ago
a year ago


Thanks - the PR has just been merged, but I imagine we need to do the same for CURLOPT_SSL_VERIFYPEER too?

openframeworks/openframeworks maintainer validated this vulnerability a year ago
Michael Rowley has been awarded the disclosure bounty
The fix bounty is now up for grabs
Michael Rowley submitted a
a year ago
Michael Rowley
a year ago


Yes, as far as I'm aware you'd ideally have CURLOPT_SSL_VERIFYPEER set to true as well as the host verification set to 2. I've submitted a pull request with these changes (linked above) - the default values for these variables is their secure ones (true & 2) but I decided to leave the curl_easy_setopt calls in to avoid any regression-based bugs, it might be simpler to remove the two lines altogether if you're sure that there is no way the values of the flags could deviate from their defaults at runtime.

a year ago


Thanks - could you submit your branch / patch as a Pull Request and we'll merge it in?

Michael Rowley
a year ago


I've opened the pull request (#6894)

We have sent a fix follow up to the openframeworks team. We will try again in 7 days. a year ago
openframeworks/openframeworks maintainer marked this as fixed in 0.12.0 with commit b4dacc a year ago
Michael Rowley has been awarded the fix bounty
This vulnerability will not receive a CVE
to join this conversation