PyPI/urllib3 CVE-2021-28363: unknown, EPSS 2.17%
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't g
Action: Upgrade urllib3 to 1.26.4 or later.
pip install urllib3==1.26.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.26.0 | 1.26.4 | - |
Fixed versions
| 1.26.4 |
Sources
- osv: PYSEC-2021-59
- https://github.com/urllib3/urllib3/commits/main
- https://pypi.org/project/urllib3/1.26.4/
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
CVE-2021-28363 · published · modified · JSON