CVE-2025-25305: SSL validation for outgoing requests in Home Assistant Core and used libs not correct

Summary

Problem: Potential man-in-the-middle attacks due to missing SSL certificate verification in the project codebase and used third-party libraries.

Details

In the past, aiohttp-session/request had the parameter verifyssl to control SSL certificate verification. This was a boolean value. In aiohttp 3.0, this parameter was deprecated in favor of the ssl parameter. Only when ssl is set to None or provided with a correct configured SSL context the standard SSL certificate verification will happen.

When migrating integrations in Home Assistant and libraries used by Home Assistant, in some cases the verifyssl parameter value was just moved to the new ssl parameter. This resulted in these integrations and 3rd party libraries using request.ssl = True, which unintentionally turned off SSL certificate verification and opened up a man-in-the-middle attack vector.

Example: https://github.com/home-assistant/core/blob/c4411914c2e906105b765c00af5740bd0880e946/homeassistant/components/discord/notify.py#L84

When you scan the libraries used by the integrations in Home Assistant, you will find more issues like this.

The general handling in Home Assistant looks good, as homeassistant.helpers.aoihttpclient.asyncgetconnector handles it correctly.

PoC

1. Check that expired.badssl.com:443 gives an SSL error in when connecting with curl or browser. 2. Add the integration adguard with the setting host=expired.badssl.com, port=443, use-ssl=true, verify-ssl=true. 3. Check the logs - you get a HTTP 403 response.

Expected behavior: 1. The integration log shows an ssl.SSLCertVerificationError.

The following code shows the problem with ssl=True. No exception is raised when ssl=True (Python 3.11.6).

import asyncio from ssl import SSLCertVerificationError

import aiohttp

BADURL = "https://expired.badssl.com/"

async def runrequest(verifyssl, resultplaceholder: str): async with aiohttp.ClientSession() as session: exceptionfired: bool = False try: await session.request("OPTIONS", BADURL, ssl=verifyssl) except SSLCertVerificationError: exceptionfired = True except Exception as error: print(error) else: exceptionfired = False print(resultplaceholder.format(exceptionresult=exceptionfired))

Case 1: ssl=False --> expected result: No exception asyncio.run(runrequest(False, "Test case 1: expected result: False - result: {exceptionresult}"))

Case 2: ssl=None --> expected result: Exception asyncio.run(runrequest(None, "Test case 2: expected result: True - result: {exceptionresult}"))

Case 3: ssl=True --> expected result: No Exception asyncio.run(runrequest(True, "Test case 3: expected result: False - result: {exceptionresult}"))