CVSS: 6.5EPSS: 0%CPEs: 3EXPL: 0CVE-2021-28363
https://notcve.org/view.php?id=CVE-2021-28363
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted. La biblioteca urllib3 versiones 1.26.x anteriores a 1.26.4 para Python, omite una comprobación del certificado SSL en algunos casos que involucran HTTPS a proxies HTTPS. La conexión inicial al proxy HTTPS (si no se proporciona un SSLContext por medio de proxy_config) no verifica el nombre de host del certificado. • https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 https://github.com/urllib3/urllib3/commits/main https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL https://pypi.org/project/urllib3/1.26.4 https://security.gentoo.org/glsa/202107-36 https://security.gentoo.org/glsa/202305-02 https://security.netapp.com/advisory/ntap-20240621-0007 htt • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 7EXPL: 0CVE-2020-26137 – python-urllib3: CRLF injection via HTTP request method
https://notcve.org/view.php?id=CVE-2020-26137
urllib3 before 1.25.9 allows CRLF injection if the attacker controls the HTTP request method, as demonstrated by inserting CR and LF control characters in the first argument of putrequest(). NOTE: this is similar to CVE-2020-26116. urllib3 versiones anteriores a 1.25.9, permite una inyección de CRLF si el atacante controla el método de petición HTTP, como es demostrado al insertar caracteres de control CR y LF en el primer argumento de la función putrequest(). NOTA: esto es similar a CVE-2020-26116 A flaw was found in python-urllib3. The HTTPConnection.request() does not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation of the request by injecting additional HTTP headers. The highest threat from this vulnerability is to confidentiality and integrity. • https://bugs.python.org/issue39603 https://github.com/urllib3/urllib3/commit/1dd69c5c5982fae7c87a620d487c2ebf7a6b436b https://github.com/urllib3/urllib3/pull/1800 https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html https://usn.ubuntu.com/4570-1 https://www.oracle.com/security-alerts/cpujul2022.html https://www.oracle.com/security-alerts/cpuoct2021.html https://access.redhat.com/security/cve/CVE-2020-26137 https& • CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2020-7212
https://notcve.org/view.php?id=CVE-2020-7212
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). • https://github.com/urllib3/urllib3/blob/master/CHANGES.rst https://github.com/urllib3/urllib3/commit/a74c9cfbaed9f811e7563cfc3dce894928e0221a https://pypi.org/project/urllib3/1.25.8 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 0CVE-2019-11324 – python-urllib3: Certification mishandle when error should be thrown
https://notcve.org/view.php?id=CVE-2019-11324
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. La urllib3 library versión anterior a 1.24.2 para Python maneja de forma incorrecta ciertos casos en los que el ajuste deseado de certificados de CA es diferente del almacén del sistema operativo de certificados de CA, lo que da como resultado que las conexiones SSL tengan éxito en situaciones en las que una falla de comprobación sea el resultado correcto. Esto está relacionado con el uso de los argumentos ssl_context, ca_certs o ca_certs_dir. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html http://www.openwall.com/lists/oss-security/2019/04/19/1 https://access.redhat.com/errata/RHSA-2019:3335 https://access.redhat.com/errata/RHSA-2019:3590 https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4 https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html https://lists.debian.org/debian-lts-announce/2023/1 • CWE-295: Improper Certificate Validation •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2019-11236 – python-urllib3: CRLF injection due to not encoding the '\r\n' sequence leading to possible attack on internal service
https://notcve.org/view.php?id=CVE-2019-11236
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter. En la librería urllib3, hasta la versión 1.24.1 para Python, se puede realizar una inyección CRLF si el atacante controla el parámetro request. • http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html https://access.redhat.com/errata/RHSA-2019:2272 https://access.redhat.com/errata/RHSA-2019:3335 https://access.redhat.com/errata/RHSA-2019:3590 https://github.com/urllib3/urllib3/issues/1553 https://lists.debian.org/debian-lts-announce/2019/06/msg00016.html https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html https:// • CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection') CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') •