| commit | 83a0f44ffd8b398673ae56c310cf5768d359c341 | [log] [tgz] |
|---|---|---|
| author | Victor Stinner <vstinner@python.org> | Thu Sep 29 01:17:27 2022 +0200 |
| committer | GitHub <noreply@github.com> | Thu Sep 29 01:17:27 2022 +0200 |
| tree | 957adec00fc1c4da195392455dc9536d146996f2 | |
| parent | a5f092f3c469b674b8d9ccbd4e4377230c9ac7cf [diff] |
gh-97612: Fix shell injection in get-remote-certificate.py (#97613) Fix a shell code injection vulnerability in the get-remote-certificate.py example script. The script no longer uses a shell to run "openssl" commands. Issue reported and initial fix by Caleb Shortt. Remove the Windows code path to send "quit" on stdin to the "openssl s_client" command: use DEVNULL on all platforms instead. Co-authored-by: Caleb Shortt <caleb@rgauge.com>