GHSA-mh33-7rrq-662w
Improper Certificate Validation in urllib3
At a glance
- Published
- Updated
- CVE
- CVE-2019-11324
- Aliases
- PYSEC-2019-133
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- CVSS_V4
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N
Description
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the `ssl_context`, `ca_certs`, or `ca_certs_dir` argument.
Affected packages
| Package | Versions |
|---|---|
| PyPI · urllib3 | introduced 0, fixed 1.24.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-11324 ADVISORY
- https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1 WEB
- https://access.redhat.com/errata/RHSA-2019:3335 WEB
- https://access.redhat.com/errata/RHSA-2019:3590 WEB
- https://github.com/advisories/GHSA-mh33-7rrq-662w ADVISORY
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2019-133.yaml WEB
- https://github.com/urllib3/urllib3 PACKAGE
- https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4 WEB
- https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html WEB
- https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72 WEB
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2 WEB
- https://pypi.org/project/urllib3/1.24.2 WEB
- https://usn.ubuntu.com/3990-1 WEB
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html WEB
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html WEB
- http://www.openwall.com/lists/oss-security/2019/04/19/1 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |