Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
### Impact Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via `proxy_config`. Only the default SSLContext is impacted. ### Patches [urllib3 >=1.26.4 has the issue resolved](https://github.com/urllib3/urllib3/releases/tag/1.26.4). urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies. ### Workarounds Upgrading is recommended as this is a minor release and not likely to break current usage. Configuring an `SSLContext` with `check_hostname=True` and passing via `proxy_config` instead of relying on the default `SSLContext` ### For more information If you have any questions or comments about this advisory: * Email us at [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-28363US | medium6.5 | — | ||
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if a… | ||||
references
External citations — patches, advisories, analysis.
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2021-59.yamlWEB
- https://github.com/pypa/advisory-db/tree/main/vulns/urllib3/PYSEC-2021-59.yamlWEB
- https://github.com/urllib3/urllib3PACKAGE
- https://github.com/urllib3/urllib3/blob/main/CHANGES.rst#1264-2021-03-15WEB
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0WEB
- https://github.com/urllib3/urllib3/commits/mainWEB
- https://github.com/urllib3/urllib3/releases/tag/1.26.4WEB
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2rWEB
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan