6.5

CVE-2021-28363

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Python ≫ Urllib3 Version >= 1.26.0 < 1.26.4
Fedoraproject ≫ Fedora Version34
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 2.11% 0.794
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 6.5 3.9 2.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
nvd@nist.gov 6.4 10 4.9
AV:N/AC:L/Au:N/C:P/I:P/A:N
CWE-295 Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

https://www.oracle.com/security-alerts/cpuoct2021.html
Patch
Third Party Advisory
https://security.netapp.com/advisory/ntap-20240621-0007/
https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
Patch
Third Party Advisory
https://github.com/urllib3/urllib3/commits/main
Patch
Third Party Advisory
https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
Third Party Advisory
Mitigation
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
https://pypi.org/project/urllib3/1.26.4/
Third Party Advisory
https://security.gentoo.org/glsa/202107-36
Third Party Advisory
https://security.gentoo.org/glsa/202305-02