CVE-2021-28363
Medium
Description
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
SeverityMedium
CVSS6.5
Exploit probability—
Product
Python Urllib3
PublishedMar 15, 2021
First seenMar 15, 2021
How to fix
Update
- python urllib31.26.4 or later
- urllib31.26.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| python urllib3 | 1.26.0 ≤ v < 1.26.4 | 1.26.4 |
| fedoraproject fedora | 34 | — |
| oracle peoplesoft_enterprise_peopletools | 8.59 | — |
| urllib3PyPI | 1.26.0 ≤ v < 1.26.4 | 1.26.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.