Bug#806637: mitmproxy --verify-upstream-cert: doesn't check if hostname matches certificate's CN/SAN (CWE-297)

[Jakub Wilk]

Control: reassign -1 python-netlib 0.13.1-1
Control: close -1 0.14-1

* Jakub Wilk <jw...@debian.org>, 2015-11-29, 18:15:

With the --verify-upstream-cert option enabled, mitmproxy is supposed to verify upstream servers certificate. However, it doesn't seem to verify that the server hostname matches a domain name in the

subject's Common Name or subjectAltName field of the certificate.

This was fixed upstream in netlib 0.14:
https://github.com/mitmproxy/netlib/commit/5af9df326aef

--
Jakub Wilk