Insecure digital certificates In python-urllib3
Description
Improper Certificate Validation in urllib3
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 debian 13 | 1.25.6-4 | ||
 pypi | 1.24.2 | ||
debian 12 | 1.25.6-4 | ||
debian 11 | 1.25.6-4 | ||
debian 14 | 1.25.6-4 | ||
 rpm rhel7 | 0:9.0.3-7.el7_8 | ||
rpm rhel8 | 0:9.0.3-16.el8 | ||
rpm rhel8 | 0:1.24.2-2.el8 |
Aliases
1. 2. 3. 4. 5. 6. 7. 8. 9. 10. 11.
References
1. 2. 3. 4. 5. 6. 7. 8. 9. 10.