PyPI: urllib3
CVE-2019-11324
Safety vulnerability ID: SFTY-20190418-57622
Safety legacy ID: pyup.io-37071
Affected versions of urllib3 are vulnerable Improper Certificate Validation. Urllib3 mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to the use of the ssl_context, ca_certs, or ca_certs_dir argument.
Overview
Improper Certificate Validation in urllib3
Advisory
Affected versions of urllib3 are vulnerable Improper Certificate Validation. Urllib3 mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to the use of the ssl_context, ca_certs, or ca_certs_dir argument.
How to Fix
Mitigation and Workarounds
---
Vulnerable Functions
Functions linked to known vulnerabilities.
References
- https://getsafety.com/vulnerabilities/SFTY-20190418-57622/CVE-2019-11324
- https://nvd.nist.gov/vuln/detail/CVE-2019-11324
- https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4
- https://access.redhat.com/errata/RHSA-2019:3335
- https://access.redhat.com/errata/RHSA-2019:3590
- https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html
- http://www.openwall.com/lists/oss-security/2019/04/19/1
- https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1
- https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
- https://github.com/advisories/GHSA-mh33-7rrq-662w
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2019-133.yaml
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2
- https://pypi.org/project/urllib3/1.24.2
- https://usn.ubuntu.com/3990-1
Verified by Safety
Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.
Learn more