PT-2019-20150 · Python · Urllib3

Publicado 2019-04-18 · Atualizado 2019-04-18

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions urllib3 versions prior to 1.24.2

Description The issue arises from the mishandling of certain cases where the desired set of CA certificates differs from the OS store of CA certificates. This results in SSL connections succeeding when they should actually fail verification. The problem is related to the use of the ssl context, ca certs, or ca certs dir argument.

Recommendations For versions prior to 1.24.2, update to version 1.24.2 or later to resolve the issue. As a temporary workaround, consider restricting the use of the ssl context, ca certs, or ca certs dir argument until the update is applied.

Identificadores relacionados

PYSEC-2019-63

Produtos afetados

Urllib3

Referências · 10

• https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4 · Nota
• http://openwall.com/lists/oss-security/2019/04/19/1 · Nota
• https://access.redhat.com/errata/RHSA-2019:3590 · Nota
• https://osv.dev/vulnerability/PYSEC-2019-63 · Aviso do Fabricante
• https://usn.ubuntu.com/3990-1 · Nota
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2 · Aviso do Fabricante
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72 · Aviso do Fabricante
• https://access.redhat.com/errata/RHSA-2019:3335 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html · Nota
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html · Nota