PYSEC-2019-63
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA…
- Severity
- Not rated yet
- No source has published a CVSS score yet
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
1.24.2- Upgrade urllib3 to this version or later
Description
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
Affected versions
PyPI
| Package | Vulnerable | Fixed in |
|---|---|---|
| urllib3 | < 1.24.2 |
1.24.2 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
urllib3 PyPI → 1.24.2
- pip
pip install --upgrade "urllib3>=1.24.2"- poetry
poetry add "urllib3>=1.24.2"- uv
uv add "urllib3>=1.24.2"
References
Other links
- github.com/urllib3/urllib3/compare/a6ec68a...1efadf4
- openwall.com/lists/oss-security/2019/04/19/1
- usn.ubuntu.com/3990-1
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
- lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html
- access.redhat.com/errata/RHSA-2019:3335
- access.redhat.com/errata/RHSA-2019:3590
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NKGPJ…
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XOSA2…
Timeline
- Published
- Last updated by the source
- Withdrawn
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-vxq7-64xx-v4gw urllib3: HTTPResponse.stream()/read_chunked() buffers an unbounded chunk-size line into memory | High | Also affects urllib3 |
| GHSA-gh4c-6fx4-qh6g urllib3: Chunked Deflate streaming can enter an infinite loop | Medium | Also affects urllib3 |
| GHSA-8988-9cw3-xx77 urllib3: HTTPS proxy TLS configuration may be ignored or overridden | High | Also affects urllib3 |
| GHSA-mf9v-mfxr-j63j urllib3: Decompression-bomb safeguards bypassed in parts of the streaming API | High | Also affects urllib3 |
| GHSA-qccp-gfcp-xxvc urllib3: Sensitive headers forwarded across origins in proxied low-level redirects | High | Also affects urllib3 |
| GHSA-38jv-5279-wg99 Decompression-bomb safeguards bypassed when following HTTP redirects (streaming API) | High | Also affects urllib3 |
| GHSA-2xpw-w6gg-jr37 urllib3 streaming API improperly handles highly compressed data | High | Also affects urllib3 |
| GHSA-gm62-xv2j-4w53 urllib3 allows an unbounded number of links in the decompression chain | High | Also affects urllib3 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor