RSS   Vulnerabilities for 'Urllib3'   RSS

2019-04-18
 
CVE-2019-11324

CWE-295
 

 
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

 
2019-04-15
 
CVE-2019-11236

CWE-93
 

 
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

 
2018-12-11
 
CVE-2018-20060

CWE-255
 

 
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

 
2017-01-11
 
CVE-2016-9015

 

 
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.

 

 >>> Vendor: Python 23 Products
Python
Virtualenv
Beaker
Keyring
Setuptools
RPLY
Pyxdg
Pillow
Requests
PIP
Tgcaptcha2
Urllib3
Python priority library
Hpack
Hyper
Openpyxl
Tablib
Simplejson
Pykerberos
Pypiserver
Python-gnupg
RSA
Novajoin


Copyright 2019, cxsecurity.com

 

Back to Top