Openssl · Openssl · CVE-2016-9015
**Name of the Vulnerable Software and Affected Versions**
urllib3 versions 1.17 through 1.18
**Description**
The issue is related to incorrect validation of TLS certificates in certain configurations, putting users at risk of man-in-the-middle and information leakage attacks. This occurs when using the optional PyOpenSSL support for TLS with OpenSSL 1.1.0 via PyOpenSSL, instead of the standard library TLS backend. The security impact is considered low due to the uncommon nature of this configuration.
**Recommendations**
For versions 1.17 and 1.18, consider disabling the use of PyOpenSSL support for TLS until a patch is available, or switch to using the standard library TLS backend to minimize the risk of exploitation.