Re: [libvirt] [sandbox PATCH 01/11] Add virt-sandbox-image

On Fri, Jul 31, 2015 at 09:15:13AM +0200, Guido Günther wrote: > On Thu, Jul 23, 2015 at 03:57:27PM +0000, Eren Yagdiran wrote: > [..snip..] > > +def get_url(server, path, headers): > > + url = "https://" + server + path > > + debug(" Fetching %s..." % url) > > + > > + req = urllib2.Request(url=url) > > This does not seem to do any certificate validation (just in case this > ends up in a distro's /usr/bin/ I can already see the CVE forthcoming). IIUC, with latest python2/3 urllib2 will now do certificate validation by default for https urls. https://bugs.python.org/issue22417