gh-91826: Document that smtplib/poplib/ftplib TLS defaults do not verify certs

Doc/library/ftplib.rst

@@ -480,6 +480,13 @@ FTP_TLS objects
       Please read :ref:`ssl-security` for best practices.
    :type context: :class:`ssl.SSLContext`
 
+   .. note::
+
+      With the default *context*, the connection is encrypted but the
+      server certificate and hostname are not verified.
+      To verify them, pass a context created by
+      :func:`ssl.create_default_context`.
+
    :param timeout:
       A timeout in seconds for blocking operations like :meth:`~FTP.connect`
       (default: the global default timeout setting).

Doc/library/poplib.rst

@@ -60,6 +60,13 @@ The :mod:`!poplib` module provides two classes:
    single (potentially long-lived) structure.  Please read :ref:`ssl-security`
    for best practices.
 
+   .. note::
+
+      With the default *context*, the connection is encrypted but the
+      server certificate and hostname are not verified.
+      To verify them, pass a context created by
+      :func:`ssl.create_default_context`.
+
    .. audit-event:: poplib.connect self,host,port poplib.POP3_SSL
 
    .. audit-event:: poplib.putline self,line poplib.POP3_SSL
@@ -235,6 +242,13 @@ A :class:`POP3` instance has the following methods:
    a single (potentially long-lived) structure.  Please read :ref:`ssl-security`
    for best practices.
 
+   .. note::
+
+      With the default *context*, the connection is encrypted but the
+      server certificate and hostname are not verified.
+      To verify them, pass a context created by
+      :func:`ssl.create_default_context`.
+
    This method supports hostname checking via
    :attr:`ssl.SSLContext.check_hostname` and *Server Name Indication* (see
    :const:`ssl.HAS_SNI`).

Doc/library/security_warnings.rst

@@ -9,20 +9,28 @@ The following modules have specific security considerations:
 
 * :mod:`base64`: :ref:`base64 security considerations <base64-security>` in
   :rfc:`4648`
+* :mod:`ftplib`: default TLS context does not verify server certificates;
+  pass a context from :func:`ssl.create_default_context` to verify them
 * :mod:`hashlib`: :ref:`all constructors take a "usedforsecurity" keyword-only
   argument disabling known insecure and blocked algorithms
   <hashlib-usedforsecurity>`
 * :mod:`http.server` is not suitable for production use, only implementing
   basic security checks. See the :ref:`security considerations <http.server-security>`.
+* :mod:`imaplib`: default TLS context does not verify server certificates;
+  pass a context from :func:`ssl.create_default_context` to verify them
 * :mod:`logging`: :ref:`Logging configuration uses eval()
   <logging-eval-security>`
 * :mod:`multiprocessing`: :ref:`Connection.recv() uses pickle
   <multiprocessing-recv-pickle-security>`
 * :mod:`pickle`: :ref:`Restricting globals in pickle <pickle-restrict>`
+* :mod:`poplib`: default TLS context does not verify server certificates;
+  pass a context from :func:`ssl.create_default_context` to verify them
 * :mod:`random` shouldn't be used for security purposes, use :mod:`secrets`
   instead
 * :mod:`shelve`: :ref:`shelve is based on pickle and thus unsuitable for
   dealing with untrusted sources <shelve-security>`
+* :mod:`smtplib`: default TLS context does not verify server certificates;
+  pass a context from :func:`ssl.create_default_context` to verify them
 * :mod:`ssl`: :ref:`SSL/TLS security considerations <ssl-security>`
 * :mod:`subprocess`: :ref:`Subprocess security considerations
   <subprocess-security>`

Doc/library/smtplib.rst

@@ -98,6 +98,13 @@ Protocol) and :rfc:`1869` (SMTP Service Extensions).
    aspects of the secure connection.  Please read :ref:`ssl-security` for
    best practices.
 
+   .. note::
+
+      With the default *context*, the connection is encrypted but the
+      server certificate and hostname are not verified.
+      To verify them, pass a context created by
+      :func:`ssl.create_default_context`.
+
    .. attribute:: SMTP_SSL.default_port
 
       The default port used for SMTP-over-SSL connections (465).
@@ -422,6 +429,13 @@ An :class:`SMTP` instance has the following methods:
    an alternative to using a keyfile and a certfile and if specified both
    *keyfile* and *certfile* should be ``None``.
 
+   .. note::
+
+      With the default *context*, the connection is encrypted but the
+      server certificate and hostname are not verified.
+      To verify them, pass a context created by
+      :func:`ssl.create_default_context`.
+
    If there has been no previous ``EHLO`` or ``HELO`` command this session,
    this method tries ESMTP ``EHLO`` first.