search

hardikvasa / google-images-download

Python Script to download hundreds of images from 'Google Images'. It is a ready-to-run code!
MIT License
8.57k stars 2.11k forks source link

Cryptographic API Misuse Vulnerability #391

Open lialon opened 3 months ago

lialon commented 3 months ago

Description:

In the "Google Images Download", I have identified a security vulnerability about insecure SSL/TLS Verification and configuration. Bypassing certificate verification or accepting all host names are considered insecure. "ssl._create_unverified_context()" shouldn't be used to create SSL/TLS context

Location:

https://github.com/hardikvasa/google-images-download/blob/master/google_images_download/google_images_download.py#L154

context = ssl._create_unverified_context()

Reference

Recommendations:

Use a SECURE SSL context with proper verification.