SSL certificate verification disabled in openframeworks/openframeworks
Mar 10th 2022
This report is strange, partially because the existence of this code has been acknowledged without any alarm about its security implication(s), and also because a pull request that would fix the vulnerability (opened as a bug patch) has been open for over two years! Having SSL certificate verification disabled is usually a bad idea because it opens users (in this case, developers' projects) to the availability of man-in-the-middle attacks that utilize self-signed SSL certificates as a way to 'spoof' a secure connection.
This vulnerability is capable of allowing attackers to intercept data sent over HTTPS connections that are handled by the
ofHttpResponse ofURLFileLoaderImpl::handleRequest(const ofHttpRequest & request)
curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYPEER, 0); curl_easy_setopt(curl.get(), CURLOPT_SSL_VERIFYHOST, 0);
Thanks - the PR has just been merged, but I imagine we need to do the same for CURLOPT_SSL_VERIFYPEER too?
Yes, as far as I'm aware you'd ideally have
CURLOPT_SSL_VERIFYPEER set to true as well as the host verification set to 2.
I've submitted a pull request with these changes (linked above) - the default values for these variables is their secure ones (true & 2) but I decided to leave the
curl_easy_setopt calls in to avoid any regression-based bugs, it might be simpler to remove the two lines altogether if you're sure that there is no way the values of the flags could deviate from their defaults at runtime.
Thanks - could you submit your branch / patch as a Pull Request and we'll merge it in?
I've opened the pull request (#6894)