Published: 15/03/2021 Updated: 07/11/2023

CVSS v2 Base Score: 6.4 | Impact Score: 4.9 | Exploitability Score: 10

CVSS v3 Base Score: 6.5 | Impact Score: 2.5 | Exploitability Score: 3.9

VMScore: 570

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:N

The urllib3 library 1.26.x prior to 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

Vulnerable Product	Search on Vulmon	Subscribe to Product
python urllib3
fedoraproject fedora 34
oracle peoplesoft enterprise peopletools 8.59

The urllib3 library 126x before 1264 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate This means certificates for different servers that still validate properly with ...

A flaw was found in python-urllib3 SSL certificate validation is omitted in some cases involving HTTPS to HTTPS proxies The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate This means certificates for different servers that still validate properly with the defaul ...

The urllib3 library 126x before 1264 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate This means certificates for different servers that still validate properly with ...

Critical Infrastructure Sectors: Critical Manufacturing

Deep dive into Clair image vulnerability scanning

Deep Dive into Clair Image Vulnerability Scanning Clair Documentation What is ClairCore Updaters and Defaults Vulnerability Databases Alpine security database secdbalpinelinuxorg/ Amazon Linux security database repodata/updateinfoxmlgz cdnamazonlinuxcom/2/core/20/x86_64/3c5ff503186aefc295ca296adf15aa0884f998fff0c78d5fc6448735eb664d26/repodata/updateinf

CWE-295 https://github.com/urllib3/urllib3/commits/main https://pypi.org/project/urllib3/1.26.4/https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r https://security.gentoo.org/glsa/202107-36 https://www.oracle.com/security-alerts/cpuoct2021.html https://security.gentoo.org/glsa/202305-02 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/https://nvd.nist.gov https://github.com/noseka1/deep-dive-into-clair https://alas.aws.amazon.com/AL2/ALAS-2021-1667.html https://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10

CVE-2021-28363

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

ICS Advisories

Github Repositories

References

Vulmon Search

About

Products

Connect