CVE-2021-28363CWE-295

CVE-2021-28363

Medium · published March 15, 2021

CVSS v3.1
6.5
EPSS
2%
Percentile
82.1
In the wild
Unconfirmed
What it is

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.02166 · 82.1th percentile
Weakness
CWE-295 · Improper Certificate Validation
Published
2021-03-15T22:15Z
Affected products (3)
ProductVersionsFixed in
python/urllib3≥ 1.26.0, < 1.26.41.26.4
fedoraproject/fedoraall versions—
oracle/peoplesoft_enterprise_peopletoolsall versions—
References (19)
https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 · [email protected]https://github.com/urllib3/urllib3/commits/main · [email protected]https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r · [email protected]https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/ · [email protected]https://pypi.org/project/urllib3/1.26.4/ · [email protected]https://security.gentoo.org/glsa/202107-36 · [email protected]https://security.gentoo.org/glsa/202305-02 · [email protected]https://security.netapp.com/advisory/ntap-20240621-0007/ · [email protected]https://www.oracle.com/security-alerts/cpuoct2021.html · [email protected]https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 · af854a3a-2127-422b-91ae-364da2661108https://github.com/urllib3/urllib3/commits/main · af854a3a-2127-422b-91ae-364da2661108https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r · af854a3a-2127-422b-91ae-364da2661108https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/ · af854a3a-2127-422b-91ae-364da2661108https://pypi.org/project/urllib3/1.26.4/ · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202107-36 · af854a3a-2127-422b-91ae-364da2661108https://security.gentoo.org/glsa/202305-02 · af854a3a-2127-422b-91ae-364da2661108https://security.netapp.com/advisory/ntap-20240621-0007/ · af854a3a-2127-422b-91ae-364da2661108https://www.oracle.com/security-alerts/cpuoct2021.html · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-398330.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 15 MAR 00:00Z
    The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies
    cvelistv5