IM
IronMonkey Threat Research

CVE-2021-28363 MEDIUM

Published: 2021-03-15 | Last Modified: 2024-11-21 | Status: Modified

Description

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

Additional Descriptions (1)

La biblioteca urllib3 versiones 1.26.x anteriores a 1.26.4 para Python, omite una comprobación del certificado SSL en algunos casos que involucran HTTPS a proxies HTTPS. La conexión inicial al proxy HTTPS (si no se proporciona un SSLContext por medio de proxy_config) no verifica el nombre de host del certificado. Esto significa que los certificados para diferentes servidores que aún se comprueban apropiadamente con el urllib3 SSLContext predeterminado serán aceptados silenciosamente

CVSS Metrics

Base Score: 6.5 (MEDIUM)

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactLOW
Integrity ImpactLOW
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 3.9

Impact Score: 2.5

Base Score: 6.4 (MEDIUM)

AV:N/AC:L/Au:N/C:P/I:P/A:N

Access VectorNETWORK
Access ComplexityLOW
AuthenticationNONE
Confidentiality ImpactPARTIAL
Integrity ImpactPARTIAL
Availability ImpactNONE

Source: [email protected]

Type: Primary

Exploitability Score: 10.0

Impact Score: 4.9

Weaknesses

Source Type Description
[email protected] Primary
en CWE-295

Affected Products

Vendor Product Version Update Type
python urllib3 * <built-in method update of dict object at 0x7fd3199b3d40> Application
fedoraproject fedora 34 <built-in method update of dict object at 0x7fd2a2f74c00> Operating System
oracle peoplesoft_enterprise_peopletools 8.59 <built-in method update of dict object at 0x7fd3420bafc0> Application

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:python:urllib3:*:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.59:*:*:*:*:*:*:*

References