CVE-2019-11324
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections
02 Description
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections
03 Exploitation and scoring
- Exploitation
- Not assessed. CISA has not published an exploitation assessment for this record, and it is not in the KEV catalog. That is an absence of assessment, not a finding of no risk.
- SSVC decision
- Not assessed by CISA
- EPSS probability
- 2.91% probability of exploitation activity in the next 30 days.
- EPSS percentile
- Equal to or higher than the score of 86.5% of scored records. A rank, not a probability.
- NVD base score
- 7.5 (CVSS v3.x), scored by the NVD independently of the CNA.
- NVD CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVD analysis status
- Modified. NVD last modified this record on 2026-06-17.
- Red Hat severity
- Moderate. Red Hat's rating for its own products, not a CVSS rating.
Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.
04 Metadata
- Published
- 2019-04-18 00:00Z7 YR AGO
- Last updated
- 2024-08-04 22:48Z2 YR AGO
- Reserved
- 2019-04-18
- Assigning CNA
- mitre
- Record state
- PUBLISHED
- Severity
- Not rated by the issuing CNA
- CNA CVSS vector
- Not published by the issuing CNA
- Weaknesses
- CWE-295Improper Certificate ValidationBase
- Data version
- 5.1
- Document digest
- e243bb0a0eb2bf969272e11cba55252a3cbb8af51fd76bef9def48f8e88b76c6
05 Affected products
06 References
- github.comhttps://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4
- www.openwall.com[oss-security] 20190418 Re: urllib3: adds system certificates to ssl_contexthttp://www.openwall.com/lists/oss-security/2019/04/19/1
- usn.ubuntu.comUSN-3990-1https://usn.ubuntu.com/3990-1/
- lists.opensuse.orgopenSUSE-SU-2019:2131http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
- lists.opensuse.orgopenSUSE-SU-2019:2133http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html
- access.redhat.comRHSA-2019:3590https://access.redhat.com/errata/RHSA-2019:3590
- access.redhat.comRHSA-2019:3335https://access.redhat.com/errata/RHSA-2019:3335
- lists.fedoraproject.orgFEDORA-2020-6148c44137https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/
- lists.fedoraproject.orgFEDORA-2020-d0d9ad17d8https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/
- lists.debian.org[debian-lts-announce] 20210615 [SECURITY] [DLA 2686-1] python-urllib3 security updatehttps://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- lists.debian.org[debian-lts-announce] 20231008 [SECURITY] [DLA 3610-1] python-urllib3 security updatehttps://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
07 Fixed in
AlmaLinux 8
- python-psycopg2-doc Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
- python2-Cython Fixed in 0.28.1-7.module_el8.6.0+2781+fed64c13
- python2-PyMySQL Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
- python2-attrs Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
- python2-chardet Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
- python2-coverage Fixed in 4.5.1-4.module_el8.6.0+2781+fed64c13
- python2-dns Fixed in 1.15.0-10.module_el8.6.0+2781+fed64c13
- python2-docs Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
- python2-docs-info Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
- python2-docutils Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
- python2-funcsigs Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
- python2-idna Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
- python2-ipaddress Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
- python2-markupsafe Fixed in 0.23-19.module_el8.6.0+2781+fed64c13
- python2-mock Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
- python2-pluggy Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
- python2-psycopg2 Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
- python2-psycopg2-debug Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
- python2-psycopg2-tests Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
- python2-py Fixed in 1.5.3-6.module_el8.6.0+2781+fed64c13
- python2-pysocks Fixed in 1.6.8-6.module_el8.6.0+2781+fed64c13
- python2-pytest Fixed in 3.4.2-13.module_el8.6.0+2781+fed64c13
- python2-pytest-mock Fixed in 1.9.0-4.module_el8.6.0+2781+fed64c13
- python2-pytz Fixed in 2017.2-12.module_el8.6.0+2781+fed64c13
- python2-pyyaml Fixed in 3.12-16.module_el8.6.0+2781+fed64c13
- python2-requests Fixed in 2.20.0-3.module_el8.6.0+2781+fed64c13
- python2-rpm-macros Fixed in 3-38.module_el8.6.0+2781+fed64c13
- python2-setuptools_scm Fixed in 1.15.7-6.module_el8.6.0+2781+fed64c13
Source: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
CloudLinux 8
- python-psycopg2-doc Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
- python2-Cython Fixed in 0.28.1-7.module_el8.6.0+2781+fed64c13
- python2-PyMySQL Fixed in 0.8.0-10.module_el8.6.0+2781+fed64c13
- python2-attrs Fixed in 17.4.0-10.module_el8.6.0+2781+fed64c13
- python2-chardet Fixed in 3.0.4-10.module_el8.6.0+2781+fed64c13
- python2-coverage Fixed in 4.5.1-4.module_el8.6.0+2781+fed64c13
- python2-dns Fixed in 1.15.0-10.module_el8.6.0+2781+fed64c13
- python2-docs Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
- python2-docs-info Fixed in 2.7.16-2.module_el8.6.0+2781+fed64c13
- python2-docutils Fixed in 0.14-12.module_el8.6.0+2781+fed64c13
- python2-funcsigs Fixed in 1.0.2-13.module_el8.6.0+2781+fed64c13
- python2-idna Fixed in 2.5-7.module_el8.6.0+2781+fed64c13
- python2-ipaddress Fixed in 1.0.18-6.module_el8.6.0+2781+fed64c13
- python2-markupsafe Fixed in 0.23-19.module_el8.6.0+2781+fed64c13
- python2-mock Fixed in 2.0.0-13.module_el8.6.0+2781+fed64c13
- python2-pluggy Fixed in 0.6.0-8.module_el8.6.0+2781+fed64c13
- python2-psycopg2 Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
- python2-psycopg2-debug Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
- python2-psycopg2-tests Fixed in 2.7.5-7.module_el8.6.0+2781+fed64c13
- python2-py Fixed in 1.5.3-6.module_el8.6.0+2781+fed64c13
- python2-pysocks Fixed in 1.6.8-6.module_el8.6.0+2781+fed64c13
- python2-pytest Fixed in 3.4.2-13.module_el8.6.0+2781+fed64c13
- python2-pytest-mock Fixed in 1.9.0-4.module_el8.6.0+2781+fed64c13
- python2-pytz Fixed in 2017.2-12.module_el8.6.0+2781+fed64c13
- python2-pyyaml Fixed in 3.12-16.module_el8.6.0+2781+fed64c13
- python2-requests Fixed in 2.20.0-3.module_el8.6.0+2781+fed64c13
- python2-rpm-macros Fixed in 3-38.module_el8.6.0+2781+fed64c13
- python2-setuptools_scm Fixed in 1.15.7-6.module_el8.6.0+2781+fed64c13
Derived from AlmaLinux 8. Partial coverage: only packages taken from AlmaLinux 8 are listed.
Source: CloudLinux errata, CloudLinux Inc. Derived from: AlmaLinux, AlmaLinux OS. Copyright (c) 2023 AlmaLinux OS. Licensed under MIT License. Received through OSV.dev. Reformatted by exploit.cc.
Debian 12
- python-urllib3 Fixed in 1.25.6-4
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 13
- python-urllib3 Fixed in 1.25.6-4
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Debian 14
- python-urllib3 Fixed in 1.25.6-4
Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.
Ubuntu 18.04 LTS
- python-urllib3 Fixed in 1.22-1ubuntu0.18.04.1
Source: Ubuntu, Canonical Ltd. Licensed under CC BY-SA 4.0. Received through OSV.dev. Reformatted by exploit.cc.
A release or ecosystem missing from this list has no record here. It may be unaffected or not covered by the source. Source notices and licences.