GHSA-5phf-pp7p-vc2r CVE-2021-28363 PYSEC-2021-59
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
- Severity
- 0.0 / 10
- Medium · CVSS 4.0
- Exploit chance (EPSS)
- 2.17%
- Chance of exploitation in the next 30 days. Higher than 82.25% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-295 Improper Certificate Validation
- Fix
1.26.4- Upgrade urllib3 to this version or later
Description
Impact
Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via proxy_config.
Only the default SSLContext is impacted.
Patches
urllib3 >=1.26.4 has the issue resolved. urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.
Workarounds
Upgrading is recommended as this is a minor release and not likely to break current usage.
Configuring an SSLContext with check_hostname=True and passing via proxy_config instead of relying on the default SSLContext
For more information
If you have any questions or comments about this advisory:
- Email us at sethmichaellarson@gmail.com
Affected versions
PyPI
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
urllib3 PyPI → 1.26.4
- pip
pip install --upgrade "urllib3>=1.26.4"- poetry
poetry add "urllib3>=1.26.4"- uv
uv add "urllib3>=1.26.4"
Severity breakdown
CVSS 4.0 0.0
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
- Attack vector
- Network
- Attack complexity
- Low
- Attack requirements
- None
- Privileges required
- None
- User interaction
- None
- Confidentiality (vulnerable system)
- Low
- Integrity (vulnerable system)
- Low
- Availability (vulnerable system)
- None
- Confidentiality (subsequent systems)
- None
- Integrity (subsequent systems)
- None
- Availability (subsequent systems)
- None
CVSS 3.1 6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Weakness
CWE-295: Improper Certificate Validation
The product does not validate, or incorrectly validates, a certificate.
How to prevent it
- Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
- Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.
References
Advisories
Packages
Other links
- github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
- github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
- github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2021-59.yaml
- github.com/pypa/advisory-db/tree/main/vulns/urllib3/PYSEC-2021-59.yaml
- github.com/urllib3/urllib3/blob/main/CHANGES.rst
- github.com/urllib3/urllib3/commits/main
- github.com/urllib3/urllib3/releases/tag/1.26.4
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S6…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S65Z…
- pypi.org/project/urllib3/1.26.4
- security.gentoo.org/glsa/202107-36
- security.gentoo.org/glsa/202305-02
- security.netapp.com/advisory/ntap-20240621-0007
- oracle.com/security-alerts/cpuoct2021.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S6…
- security.netapp.com/advisory/ntap-20240621-0007
- cert-portal.siemens.com/productcert/html/ssa-398330.html
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-vxq7-64xx-v4gw urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory | High | Also affects urllib3 |
| GHSA-gh4c-6fx4-qh6g urllib3: Chunked Deflate streaming can enter an infinite loop | Medium | Also affects urllib3 |
| GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden | High | Also affects urllib3 |
| GHSA-mf9v-mfxr-j63j urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API | High | Also affects urllib3 |
| GHSA-qccp-gfcp-xxvc urllib3: Sensitive headers forwarded across origins in proxied low-level redirects | High | Also affects urllib3 |
| GHSA-38jv-5279-wg99 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) | High | Also affects urllib3 |
| GHSA-2xpw-w6gg-jr37 urllib3 streaming API improperly handles highly compressed data | High | Also affects urllib3 |
| GHSA-gm62-xv2j-4w53 urllib3 allows an unbounded number of links in the decompression chain | High | Also affects urllib3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor