GHSA-mh33-7rrq-662w CVE-2019-11324 PYSEC-2019-133

Improper Certificate Validation in urllib3

High PyPI

Severity: 0.0 / 10; High · CVSS 4.0
Exploit chance (EPSS): 2.92%; Chance of exploitation in the next 30 days. Higher than 87.01% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-295 Improper Certificate Validation
Fix: 1.24.2; Upgrade urllib3 to this version or later

Description

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

Affected versions

PyPI

Package	Vulnerable	Fixed in
urllib3	`< 1.24.2`	`1.24.2`
urllib3	`< 1.24.2`	`1.24.2`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

urllib3 PyPI → `1.24.2`

pip

pip install --upgrade "urllib3>=1.24.2"

poetry

poetry add "urllib3>=1.24.2"

uv

uv add "urllib3>=1.24.2"

Severity breakdown

CVSS 4.0 0.0

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Attack vector: Network
Attack complexity: Low
Attack requirements: None
Privileges required: None
User interaction: None
Confidentiality (vulnerable system): None
Integrity (vulnerable system): High
Availability (vulnerable system): None
Confidentiality (subsequent systems): None
Integrity (subsequent systems): None
Availability (subsequent systems): None

CVSS 3.0 7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack vector: Network
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: High
Availability: None

Weakness

CWE-295: Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

How to prevent it

Architecture and Design, Implementation: Certificates should be carefully managed and checked to assure that data are encrypted with the intended owner's public key.
Implementation: If certificate pinning is being used, ensure that all relevant properties of the certificate are fully validated before the certificate is pinned, including the hostname.

References

Advisories

Packages

github.com/urllib3/urllib3

Timeline

Apr 18, 2019 Published
Nov 18, 2024 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-vxq7-64xx-v4gw urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory	High	Also affects urllib3
GHSA-gh4c-6fx4-qh6g urllib3: Chunked Deflate streaming can enter an infinite loop	Medium	Also affects urllib3
GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden	High	Also affects urllib3
GHSA-mf9v-mfxr-j63j urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API	High	Also affects urllib3
GHSA-qccp-gfcp-xxvc urllib3: Sensitive headers forwarded across origins in proxied low-level redirects	High	Also affects urllib3
GHSA-38jv-5279-wg99 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API)	High	Also affects urllib3
GHSA-2xpw-w6gg-jr37 urllib3 streaming API improperly handles highly compressed data	High	Also affects urllib3
GHSA-gm62-xv2j-4w53 urllib3 allows an unbounded number of links in the decompression chain	High	Also affects urllib3

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor