Vulnerability Details : CVE-2021-28363
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
Products affected by CVE-2021-28363
- cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
- cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2021-28363
0.13%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 30 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2021-28363
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.4
|
MEDIUM | AV:N/AC:L/Au:N/C:P/I:P/A:N |
10.0
|
4.9
|
NIST | |
|
6.5
|
MEDIUM | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N |
3.9
|
2.5
|
NIST |
CWE ids for CVE-2021-28363
-
The product does not validate, or incorrectly validates, a certificate.Assigned by: nvd@nist.gov (Primary)
References for CVE-2021-28363
-
https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection · Advisory · urllib3/urllib3 · GitHubMitigation;Third Party Advisory
-
https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
Merge pull request from GHSA-5phf-pp7p-vc2r · urllib3/urllib3@8d65ea1 · GitHubPatch;Third Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
[SECURITY] Fedora 34 Update: python-pip-21.0.1-3.fc34 - package-announce - Fedora Mailing-Lists
-
https://security.netapp.com/advisory/ntap-20240621-0007/
May 2024 IBM Cognos Analytics Vulnerabilities in NetApp Products | NetApp Product Security
-
https://security.gentoo.org/glsa/202107-36
urllib3: Multiple vulnerabilities (GLSA 202107-36) — Gentoo securityThird Party Advisory
-
https://github.com/urllib3/urllib3/commits/main
Commits · urllib3/urllib3 · GitHubPatch;Third Party Advisory
-
https://www.oracle.com/security-alerts/cpuoct2021.html
Oracle Critical Patch Update Advisory - October 2021Patch;Third Party Advisory
-
https://security.gentoo.org/glsa/202305-02
Python, PyPy3: Multiple Vulnerabilities (GLSA 202305-02) — Gentoo security
-
https://pypi.org/project/urllib3/1.26.4/
urllib3 · PyPIThird Party Advisory
-
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
[SECURITY] Fedora 34 Update: python-pip-21.0.1-3.fc34 - package-announce - Fedora Mailing-ListsMailing List;Third Party Advisory
Jump to