GitHub Advisoryadvisory · PyPI

GHSA-mh33-7rrq-662w Improper Certificate Validation in urllib3

HIGH Published 2019-04-19 Modified 2024-11-18 Official page ↗
Aliases
CVE-2019-11324
Ecosystem
PyPI
Packages
urllib3
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-295
Reviewed
2019-04-19

Affected packages

• PyPI urllib3: < 1.24.2 → fixed in 1.24.2

Description

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the `ssl_context`, `ca_certs`, or `ca_certs_dir` argument.

Related

Alias · CVE (1)

  • CVE-2019-11324 The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS… vulnerability

Weakness · CWE (1)

  • CWE-295 Improper Certificate Validation weakness

References