CVE-2021-28363
En bref
- Source
- NVD
- EPSS
- EPSS 2.17 % · centile 82 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- mitre
- Statut NVD
- Modified
Description
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
Faiblesses (CWE)
- CWE-295 — Validation incorrecte de certificat
Références
- https://github.com/urllib3/urllib3/commits/main
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
- https://security.gentoo.org/glsa/202107-36
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://pypi.org/project/urllib3/1.26.4/
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-5phf-pp7p-vc2r — Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
- PYSEC-2021-59 — The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to t
Références européennes
- ENISA EUVD · EUVD-2021-0457
- GCVE · GCVE-0-2021-28363
Avis du CERT-FR
- CERTFR-2024-AVI-0366 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
- CERTFR-2023-AVI-1015 — Multiples vulnérabilités dans les produits Siemens · cert.ssi.gouv.fr
- CERTFR-2021-AVI-804 — Multiples vulnérabilités dans Oracle PeopleSoft · cert.ssi.gouv.fr
- CERTFR-2021-AVI-505 — Multiples vulnérabilités dans IBM Spectrum · cert.ssi.gouv.fr
- CERTFR-2021-AVI-490 — Multiples vulnérabilités dans IBM Spectrum Protect · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*≥ 1.26.0 < 1.26.4cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |