Design/Logic Flaw

🗓️ 15 Mar 2021 18:15:00Reported by PRIOn knowledge baseType

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies

Reporter	Title	Published	Views	Family All 54
IBM Security Bulletins	Security Bulletin: IBM Watson Assistant for IBM Cloud Pak for Data is vulnerable to urllib3 for python man-in-the-middle and security bypass vulnerabilities( CVE-2021-3572,CVE-2021-28363,)	5 Jul 202321:24	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Redis, MinIO, Golang, and Urllib3 affect IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes and OpenShift	28 Jun 202120:36	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in the Python, Python cryptography , and Urllib3 affect IBM Spectrum Discover.	30 Jul 202105:01	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Python, Tornado, and Urllib3 affect IBM Spectrum Protect Plus Microsoft File Systems Backup and Restore	28 Jun 202120:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	20 Jun 202416:51	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to multiple Base OS issues	1 Mar 202418:03	–	ibm
IBM Security Bulletins	Security Bulletin: urllib upgrade CVE-2021-33503, CVE-2021-28363	18 Mar 202217:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Python urllib3	25 Jun 202100:35	–	ibm
Tenable Nessus	Amazon Linux 2 : python-pip (ALAS-2021-1667)	4 Jan 202300:00	–	nessus
Tenable Nessus	GLSA-202107-36 : urllib3: Multiple vulnerabilities	24 Jan 202200:00	–	nessus

Source	Link
github	www.github.com/urllib3/urllib3/commits/main
pypi	www.pypi.org/project/urllib3/1.26.4/
github	www.github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
github	www.github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
lists	www.lists.fedoraproject.org/archives/list/[email protected]/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
security	www.security.gentoo.org/glsa/202107-36
oracle	www.oracle.com/security-alerts/cpuoct2021.html
security	www.security.gentoo.org/glsa/202305-02

03 May 2023 11:15Current

6.4Medium risk

Vulners AI Score6.4

EPSS0.00124