pysec - pysec-2021-59

pysec-2021-59

Vulnerability from pysec

Published

2021-03-15 18:15

Modified

2021-03-23 16:47

Details

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "urllib3",
        "purl": "pkg:pypi/urllib3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0"
            }
          ],
          "repo": "https://github.com/urllib3/urllib3",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "1.26.0"
            },
            {
              "fixed": "1.26.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "1.26.0",
        "1.26.1",
        "1.26.2",
        "1.26.3"
      ]
    }
  ],
  "aliases": [
    "CVE-2021-28363",
    "GHSA-5phf-pp7p-vc2r"
  ],
  "details": "The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn\u0027t given via proxy_config) doesn\u0027t verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.",
  "id": "PYSEC-2021-59",
  "modified": "2021-03-23T16:47:00Z",
  "published": "2021-03-15T18:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/commits/main"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/urllib3/1.26.4/"
    },
    {
      "type": "FIX",
      "url": "https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r"
    }
  ]
}

ghsa-5phf-pp7p-vc2r

Vulnerability from github

Published

2021-03-19 19:42

Modified

2024-11-18 22:42

Severity ?

6.5 (Medium) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Summary

Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection

Details

Impact

Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via proxy_config. Only the default SSLContext is impacted.

Patches

urllib3 >=1.26.4 has the issue resolved. urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.

Workarounds

Upgrading is recommended as this is a minor release and not likely to break current usage.

Configuring an SSLContext with check_hostname=True and passing via proxy_config instead of relying on the default SSLContext

For more information

If you have any questions or comments about this advisory: * Email us at sethmichaellarson@gmail.com

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "urllib3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.26.0"
            },
            {
              "fixed": "1.26.4"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-28363"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-295"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-03-19T19:41:48Z",
    "nvd_published_at": "2021-03-15T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nUsers who are using an HTTPS proxy to issue HTTPS requests and haven\u0027t configured their own SSLContext via `proxy_config`.\nOnly the default SSLContext is impacted.\n\n### Patches\n\n[urllib3 \u003e=1.26.4 has the issue resolved](https://github.com/urllib3/urllib3/releases/tag/1.26.4). urllib3\u003c1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.\n\n### Workarounds\n\nUpgrading is recommended as this is a minor release and not likely to break current usage.\n\nConfiguring an `SSLContext` with `check_hostname=True` and passing via `proxy_config` instead of relying on the default `SSLContext`\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)",
  "id": "GHSA-5phf-pp7p-vc2r",
  "modified": "2024-11-18T22:42:40Z",
  "published": "2021-03-19T19:42:11Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28363"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2021-59.yaml"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-db/tree/main/vulns/urllib3/PYSEC-2021-59.yaml"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/urllib3/urllib3"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/blob/main/CHANGES.rst#1264-2021-03-15"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/commits/main"
    },
    {
      "type": "WEB",
      "url": "https://github.com/urllib3/urllib3/releases/tag/1.26.4"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL"
    },
    {
      "type": "WEB",
      "url": "https://pypi.org/project/urllib3/1.26.4"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202107-36"
    },
    {
      "type": "WEB",
      "url": "https://security.gentoo.org/glsa/202305-02"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20240621-0007"
    },
    {
      "type": "WEB",
      "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Using default SSLContext for HTTPS requests in an HTTPS proxy doesn\u0027t verify certificate hostname for proxy connection"
}

cve-2021-28363

Vulnerability from cvelistv5

Published

2021-03-15 00:00

Modified

2024-08-03 21:40

Severity ?

Summary

References

▼	URL	Tags
	https://github.com/urllib3/urllib3/commits/main
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/	vendor-advisory
	https://security.gentoo.org/glsa/202107-36	vendor-advisory
	https://www.oracle.com/security-alerts/cpuoct2021.html
	https://pypi.org/project/urllib3/1.26.4/
	https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
	https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
	https://security.gentoo.org/glsa/202305-02	vendor-advisory
	https://security.netapp.com/advisory/ntap-20240621-0007/

Impacted products

Vendor

Product

Version

▼

n/a

Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T21:40:14.323Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/urllib3/urllib3/commits/main"
          },
          {
            "name": "FEDORA-2021-3f378dda90",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/"
          },
          {
            "name": "GLSA-202107-36",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202107-36"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://pypi.org/project/urllib3/1.26.4/"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r"
          },
          {
            "name": "GLSA-202305-02",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://security.gentoo.org/glsa/202305-02"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20240621-0007/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn\u0027t given via proxy_config) doesn\u0027t verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-06-21T19:08:26.504484",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "url": "https://github.com/urllib3/urllib3/commits/main"
        },
        {
          "name": "FEDORA-2021-3f378dda90",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/"
        },
        {
          "name": "GLSA-202107-36",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202107-36"
        },
        {
          "url": "https://www.oracle.com/security-alerts/cpuoct2021.html"
        },
        {
          "url": "https://pypi.org/project/urllib3/1.26.4/"
        },
        {
          "url": "https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0"
        },
        {
          "url": "https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r"
        },
        {
          "name": "GLSA-202305-02",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://security.gentoo.org/glsa/202305-02"
        },
        {
          "url": "https://security.netapp.com/advisory/ntap-20240621-0007/"
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2021-28363",
    "datePublished": "2021-03-15T00:00:00",
    "dateReserved": "2021-03-13T00:00:00",
    "dateUpdated": "2024-08-03T21:40:14.323Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2021-59

Vulnerability from pysec

ghsa-5phf-pp7p-vc2r

Vulnerability from github

Impact

Patches

Workarounds

For more information

cve-2021-28363

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature