The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
Fix
Patch, vendor advisory and mitigation references on NVD 8
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 Patch, Third Party Advisory
- https://github.com/urllib3/urllib3/commits/main Patch, Third Party Advisory
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r Mitigation, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 Patch, Third Party Advisory
- https://github.com/urllib3/urllib3/commits/main Patch, Third Party Advisory
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r Mitigation, Third Party Advisory
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 1
- First seenCVSS 6.5 · python, fedoraproject, oracleNVD modified 2026-10-14 12:17
Affected (CPE criteria) 3
cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*
References 19
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 Patch, Third Party Advisory
- https://github.com/urllib3/urllib3/commits/main Patch, Third Party Advisory
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r Mitigation, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
- https://pypi.org/project/urllib3/1.26.4/ Third Party Advisory
- https://security.gentoo.org/glsa/202107-36 Third Party Advisory
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 Patch, Third Party Advisory
- https://github.com/urllib3/urllib3/commits/main Patch, Third Party Advisory
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r Mitigation, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
- https://pypi.org/project/urllib3/1.26.4/ Third Party Advisory
- https://security.gentoo.org/glsa/202107-36 Third Party Advisory
- https://security.gentoo.org/glsa/202305-02
- https://security.netapp.com/advisory/ntap-20240621-0007/
- https://www.oracle.com/security-alerts/cpuoct2021.html Patch, Third Party Advisory
- https://cert-portal.siemens.com/productcert/html/ssa-398330.html