Index: u1db/u1db/remote/ssl_match_hostname.py
===================================================================
--- u1db.orig/u1db/remote/ssl_match_hostname.py	2014-06-20 11:37:52.589038085 -0400
+++ u1db/u1db/remote/ssl_match_hostname.py	2014-06-20 11:38:24.860168469 -0400
@@ -10,9 +10,16 @@
     pass
 
 
-def _dnsname_to_pat(dn):
+def _dnsname_to_pat(dn, max_wildcards=1):
     pats = []
     for frag in dn.split(r'.'):
+        if frag.count('*') > max_wildcards:
+            # Issue #17980: avoid denials of service by refusing more
+            # than one wildcard per fragment.  A survery of established
+            # policy among SSL implementations showed it to be a
+            # reasonable choice.
+            raise CertificateError(
+                "too many wildcards in certificate DNS name: " + repr(dn))
         if frag == '*':
             # When '*' is a fragment by itself, it matches a non-empty dotless
             # fragment.
