CVE-2021-28363
2 advisories.
PyPI/urllib3 CVE-2021-28363: medium 6.5
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
Action: Upgrade urllib3 to 1.26.4 or later.
pip install urllib3==1.26.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.26.0 | 1.26.4 | - |
Fixed versions
| 1.26.4 |
Sources
- osv: GHSA-5phf-pp7p-vc2r
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
- https://nvd.nist.gov/vuln/detail/CVE-2021-28363
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2021-59.yaml
- https://github.com/pypa/advisory-db/tree/main/vulns/urllib3/PYSEC-2021-59.yaml
- https://github.com/urllib3/urllib3
- https://github.com/urllib3/urllib3/blob/main/CHANGES.rst#1264-2021-03-15
- https://github.com/urllib3/urllib3/commits/main
- https://github.com/urllib3/urllib3/releases/tag/1.26.4
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL
- https://pypi.org/project/urllib3/1.26.4
- https://security.gentoo.org/glsa/202107-36
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20240621-0007
- https://www.oracle.com/security-alerts/cpuoct2021.html
CVE-2021-28363 · published · modified · JSON
PyPI/urllib3 CVE-2021-28363: unknown
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't g
Action: Upgrade urllib3 to 1.26.4 or later.
pip install urllib3==1.26.4Affected
| introduced | fixed | last affected |
|---|---|---|
| 1.26.0 | 1.26.4 | - |
Fixed versions
| 1.26.4 |
Sources
- osv: PYSEC-2021-59
- https://github.com/urllib3/urllib3/commits/main
- https://pypi.org/project/urllib3/1.26.4/
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
CVE-2021-28363 · published · modified · JSON