We should not check for updates without SSL.

const UPDATE_DEFAULT_URL = 'http://updates.drupal.org/release-history';

We should also not download any update without SSL. Otherwise man in the middle attacks are possible and an attacker may disrupt/redirect the download to an install package with a backdoor.

Comments

hass’s picture

hass CreditAttribution: hass commented
Status: Active » Closed (duplicate)
Parent issue: » #1538118: Update status does not verify the identity or authenticity of the release history URL