The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

🗓️ 03 Sep 2025 23:00:29Reported by MicrosoftType

urllib3 before 1.24.2 mishandles mismatched certificates via secure sockets layer context or certificate store, enabling incorrect verification.

Reporter	Title	Published	Views	Family All 191
IBM Security Bulletins	Security Bulletin: App Connect Enterprise Certified Container is vulnerable to CVE-2019-11324	1 Oct 202009:55	–	ibm
IBM Security Bulletins	Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	27 Jan 202100:05	–	ibm
IBM Security Bulletins	Security Bulletin: vulnerability in urllib3 library embedded into Tensorboard PowerAI CVE-2019-11324	1 Jul 201917:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Spectrum Symphony with urllib3 could allow a remote attacker to obtain sensitive information	28 Feb 202415:27	–	ibm
IBM Security Bulletins	Security Bulletin: IBM WebSphere Automation is vulnerable to multiple security vulnerabilites	27 Mar 202617:49	–	ibm
IBM Security Bulletins	Security Bulletin: IBM SOAR QRadar Plugin App is vulnerable to using components with known vulnerabilities	3 May 202419:55	–	ibm
FreeBSD	urllib3 -- multiple vulnerabilities	11 Dec 201800:00	–	freebsd
Tenable Nessus	Amazon Linux 2 : python-pip (ALAS-2020-1389)	10 Feb 202000:00	–	nessus
Tenable Nessus	Amazon Linux AMI : python-pip (ALAS-2020-1340)	10 Feb 202000:00	–	nessus
Tenable Nessus	Alibaba Cloud Linux 3 : 0112: python27:2.7 (ALINUX3-SA-2022:0112)	14 May 202500:00	–	nessus

03 Sep 2025 23:00Current

9.6High risk

Vulners AI Score9.6

CVSS 25

CVSS 37.5

EPSS0.02836