From bd441cd1b1b77a35fb8162b3450bd4dc6740e392 Mon Sep 17 00:00:00 2001 From: Nizamudeen A Date: Thu, 30 Oct 2025 10:05:04 +0530 Subject: [PATCH] [PATCH] mgr/alerts: enforce ssl context to SMTP_SSL Fixes: https://github.com/ceph/ceph/security/advisories/GHSA-xj9f-7g59-m4jx Signed-off-by: Nizamudeen A (cherry picked from commit 5f7fc5267e55089eeb1cfc87e9c1215c32439102) Gbp-Pq: Name CVE-2024-31884.patch --- src/pybind/mgr/alerts/module.py | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/pybind/mgr/alerts/module.py b/src/pybind/mgr/alerts/module.py index d6cec4b64..a1ebaf064 100644 --- a/src/pybind/mgr/alerts/module.py +++ b/src/pybind/mgr/alerts/module.py @@ -8,6 +8,7 @@ from threading import Event import errno import json import smtplib +import ssl class Alerts(MgrModule): COMMANDS = [ @@ -238,8 +239,9 @@ class Alerts(MgrModule): # send try: + context = ssl.create_default_context() if self.smtp_ssl: - server = smtplib.SMTP_SSL(self.smtp_host, self.smtp_port) + server = smtplib.SMTP_SSL(self.smtp_host, self.smtp_port, context=context) else: server = smtplib.SMTP(self.smtp_host, self.smtp_port) if self.smtp_password: -- 2.30.2