PT-2021-17850 · Pypi+1 · Urllib3+1

Published 2021-03-15 · Updated 2026-06-03 · CVE-2021-28363

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions: urllib3 versions 1.26.x through 1.26.3

Description: The issue concerns the omission of SSL certificate validation in certain cases involving HTTPS to HTTPS proxies. Specifically, when an SSLContext is not provided via proxy config, the initial connection to the HTTPS proxy does not verify the hostname of the certificate. This allows certificates for different servers to be silently accepted if they validate properly with the default urllib3 SSLContext. The issue affects users who use an HTTPS proxy to issue HTTPS requests without configuring their own SSLContext.

Recommendations: For urllib3 versions 1.26.x through 1.26.3, upgrade to urllib3 version 1.26.4 or later to resolve the issue. As a temporary workaround, consider configuring an SSLContext with check hostname=True and passing it via proxy config instead of relying on the default SSLContext.

Fix

Improper Certificate Validation

Weakness Enumeration

CWE-295

Related Identifiers

ALT-PU-2021-1772

BDU:2025-04191

CVE-2021-28363

GHSA-5PHF-PP7P-VC2R

MGASA-2021-0371

MGASA-2021-0377

PYSEC-2021-59

Affected Products

Alt Linux

Urllib3

References · 45

• https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 · Patch
• https://github.com/urllib3/urllib3/commits/main · Patch
• https://osv.dev/vulnerability/GHSA-5phf-pp7p-vc2r · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28363 · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL · Vendor Advisory
• https://osv.dev/vulnerability/ROOT-APP-PYPI-CVE-2021-28363 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/3L3JUBMPJJ7WYXI6JHX6KKYPPX676PR6 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-28363 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0371.html · Security Note
• https://security.gentoo.org/glsa/202305-02 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2021-59 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0371 · Vendor Advisory
• https://oracle.com/security-alerts/cpuoct2021.html · Patch
• https://lists.fedoraproject.org/archives/list/[e-mail]/thread/JWEE334W43EIJUKSMQSEH6ML7VU57K5B · Vendor Advisory