Lucene search
Veracode Vulnerability DatabaseVERACODE:29711HistoryMar 16, 2021 - 4:13 a.m.
Man-in-the-Middle (MitM)
2021-03-1604:13:16
Veracode Vulnerability Database
sca.analysiscenter.veracode.com
15
urllib3
ssl certificate
validation
https
proxies
hostname verification
EPSS
0.001
Percentile
49.3%
urllib3 is vulnerable to man-in-the-middle attack. The SSL certificate validation is omitted in certain HTTPS to HTTPS proxies. When an SSL Context is not given via proxy_config, the hostname of the certificate is not verified in the initial connection.
References
github.com/advisories/GHSA-5phf-pp7p-vc2r
github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
github.com/urllib3/urllib3/commits/main
github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
lists.fedoraproject.org/archives/list/[email protected]/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
pypi.org/project/urllib3/1.26.4/
security.gentoo.org/glsa/202107-36
www.oracle.com/security-alerts/cpuoct2021.html
Related
ibm
ibm
redhatcve
redhatcve
CVE-2021-28363
2021-03-31 12:39:27
alpinelinux
alpinelinux
CVE-2021-28363
2021-03-15 18:15:19
amazon
amazon
Medium: python-pip
2021-06-16 20:37:00
Medium: python-pip
2022-01-18 21:38:00
slackware
slackware
[slackware-security] python3
2022-03-18 20:17:59
ubuntucve
ubuntucve
CVE-2021-28363
2021-03-15 00:00:00
cvelist
cvelist
CVE-2021-28363
2021-03-15 00:00:00
nvd
nvd
CVE-2021-28363
2021-03-15 18:15:19
osv
osv
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
2021-03-19 19:42:11
PYSEC-2021-59
2021-03-15 18:15:00
CVE-2021-28363
2021-03-15 18:15:19
prion
prion
Design/Logic Flaw
2021-03-15 18:15:00
openvas
openvas
Slackware: Security Advisory (SSA:2022-077-01)
2022-04-21 00:00:00
Fedora: Security Advisory for python-pip (FEDORA-2021-3f378dda90)
2021-05-27 00:00:00
Mageia: Security Advisory (MGASA-2021-0377)
2022-01-28 00:00:00
nessus
nessus
Amazon Linux 2 : python-pip (ALAS-2021-1667)
2023-01-04 00:00:00
Slackware Linux 15.0 / current python3 Vulnerability (SSA:2022-077-01)
2022-03-18 00:00:00
GLSA-202107-36 : urllib3: Multiple vulnerabilities
2022-01-24 00:00:00
cve
cve
CVE-2021-28363
2021-03-15 18:15:19
github
github
fedora
fedora
[SECURITY] Fedora 34 Update: python-pip-21.0.1-3.fc34
2021-05-24 01:02:16
debiancve
debiancve
CVE-2021-28363
2021-03-15 18:15:19
mageia
mageia
Updated python-urllib3 package fixes security vulnerabilities
2021-07-27 23:21:53
Updated python-pip packages fix security vulnerabilities
2021-07-25 17:45:06
gentoo
gentoo
urllib3: Multiple vulnerabilities
2021-07-15 00:00:00
Python, PyPy3: Multiple Vulnerabilities
2023-05-03 00:00:00
oracle
oracle
Oracle Critical Patch Update Advisory - October 2021
2021-10-19 00:00:00
ics
ics
Siemens SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1
2023-12-14 12:00:00