CVE-2021-28363 – urllib3

Package

Manager: pip
Name: urllib3
Vulnerable Version: >=1.26.0 <1.26.4

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.00107 pctl0.29431

Details

Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection ### Impact Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via `proxy_config`. Only the default SSLContext is impacted. ### Patches [urllib3 >=1.26.4 has the issue resolved](https://github.com/urllib3/urllib3/releases/tag/1.26.4). urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies. ### Workarounds Upgrading is recommended as this is a minor release and not likely to break current usage. Configuring an `SSLContext` with `check_hostname=True` and passing via `proxy_config` instead of relying on the default `SSLContext` ### For more information If you have any questions or comments about this advisory: * Email us at [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)

Metadata

Created: 2021-03-19T19:42:11Z
Modified: 2024-11-18T22:42:40Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-5phf-pp7p-vc2r/GHSA-5phf-pp7p-vc2r.json
CWE IDs: ["CWE-295"]
Alternative ID: GHSA-5phf-pp7p-vc2r
Finding: F163
Auto approve: 1