SSL/TLS certificates are not validated!

[dmth]

Hi Folks,

from my Impression current imbox does not validate SSL/TLS certificates.

https://github.com/martinrusev/imbox/blob/master/imbox/imap.py#L21

calls IMAP4_SSL default constructor which looks like:

imaplib.IMAP4_SSL(host='', port=IMAP4_SSL_PORT, keyfile=None, certfile=None, ssl_context=None)

As you can see at ssl_context=None. This default configuration does not validate SSL/TLS certificates!

Using the default configuration makes software using Imbox vulnerable!

Idea to solve this problem (untested sketch code!)

import ssl as pythonssllib

       if ssl:
            context = pythonssllib.create_default_context()
            if not self.port:
                self.port = 993
            self.server = self.IMAP4_SSL(self.hostname, self.port, ssl_context=context)
        else:
            if not self.port:
                self.port = 143
            self.server = self.IMAP4(self.hostname, self.port)     

Issuetrace: certtools/intelmq#532

[ghost]

I think this can be closed