// For flags

CVE-2016-9015

 

Severity Score

3.7
*CVSS v3

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.

Versiones 1.17 y 1.18 de la librería de Python urllib3 sufren una vulnerabilidad que puede provocarles, en ciertas configuraciones, que no validen correctamente certificados TLS. Esto coloca a usuarios de la librería con aquellas configuraciones en peligro de ataques man-in-the-middle y de filtración de información. Esta vulnerabilidad afecta a usuarios que utilizan versiones 1.17 y 1.18 de la librería urllib3, que están utilizando el soporte PyOpenSSL opcional para TLS en lugar del backend TLS regular de una librería estándar, y que están usando OpenSSL 1.1.0 a través de PyOpenSSL. Esta es una configuración extremadamente poco común, por lo que el impacto de seguridad de esta vulnerabilidad es bajo.

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None
Attack Vector
Network
Attack Complexity
High
Authentication
None
Confidentiality
Partial
Integrity
None
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2016-10-25 CVE Reserved
  • 2017-01-11 CVE Published
  • 2023-03-08 EPSS Updated
  • 2024-08-06 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-295: Improper Certificate Validation
CAPEC
References (2)
URL Tag Source
http://www.openwall.com/lists/oss-security/2016/10/27/6 Mailing List
http://www.securityfocus.com/bid/93941 Third Party Advisory
URL Date SRC
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Python
Search vendor "Python"
 Urllib3
Search vendor "Python" for product "Urllib3"
 1.17
Search vendor "Python" for product "Urllib3" and version "1.17"
-
Affected
Python
Search vendor "Python"
 Urllib3
Search vendor "Python" for product "Urllib3"
 1.18
Search vendor "Python" for product "Urllib3" and version "1.18"
-
Affected