CVE-2021-28363
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
La biblioteca urllib3 versiones 1.26.x anteriores a 1.26.4 para Python, omite una comprobación del certificado SSL en algunos casos que involucran HTTPS a proxies HTTPS. La conexión inicial al proxy HTTPS (si no se proporciona un SSLContext por medio de proxy_config) no verifica el nombre de host del certificado. Esto significa que los certificados para diferentes servidores que aún se comprueban apropiadamente con el urllib3 SSLContext predeterminado serán aceptados silenciosamente
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-03-13 CVE Reserved
- 2021-03-15 CVE Published
- 2023-11-29 EPSS Updated
- 2024-08-03 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-295: Improper Certificate Validation
CAPEC
References (9)
| URL | Tag | Source |
|---|---|---|
| https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r | Mitigation | |
| https://pypi.org/project/urllib3/1.26.4 | Third Party Advisory | |
| https://security.netapp.com/advisory/ntap-20240621-0007 |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 | 2024-06-21 | |
| https://github.com/urllib3/urllib3/commits/main | 2024-06-21 | |
| https://www.oracle.com/security-alerts/cpuoct2021.html | 2024-06-21 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Python Search vendor "Python" | Urllib3 Search vendor "Python" for product "Urllib3" | >= 1.26.0 < 1.26.4 Search vendor "Python" for product "Urllib3" and version " >= 1.26.0 < 1.26.4" | - |
Affected
| ||||||
| Fedoraproject Search vendor "Fedoraproject" | Fedora Search vendor "Fedoraproject" for product "Fedora" | 34 Search vendor "Fedoraproject" for product "Fedora" and version "34" | - |
Affected
| ||||||
| Oracle Search vendor "Oracle" | Peoplesoft Enterprise Peopletools Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" | 8.59 Search vendor "Oracle" for product "Peoplesoft Enterprise Peopletools" and version "8.59" | - |
Affected
| ||||||