RSS   Podatności dla 'Urllib3'   RSS

2021-06-29
 
CVE-2021-33503

CWE-400
 
 
An issue was discovered in urllib3 before 1.26.5. When provided with a URL containing many @ characters in the authority component, the authority regular expression exhibits catastrophic backtracking, causing a denial of service if a URL were passed as a parameter or redirected to via an HTTP redirect.

 
2021-03-15
 
CVE-2021-28363

CWE-295
 
 
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

 
2020-03-06
 
CVE-2020-7212

CWE-400
 
 
The _encode_invalid_chars function in util/url.py in the urllib3 library 1.25.2 through 1.25.7 for Python allows a denial of service (CPU consumption) because of an inefficient algorithm. The percent_encodings array contains all matches of percent encodings. It is not deduplicated. For a URL of length N, the size of percent_encodings may be up to O(N). The next step (normalize existing percent-encoded bytes) also takes up to O(N) for each step, so the total time is O(N^2). If percent_encodings were deduplicated, the time to compute _encode_invalid_chars would be O(kN), where k is at most 484 ((10+6*2)^2).

 
2019-04-18
 
CVE-2019-11324

CWE-295
 
 
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

 
2019-04-15
 
CVE-2019-11236

CWE-93
 
 
In the urllib3 library through 1.24.1 for Python, CRLF injection is possible if the attacker controls the request parameter.

 
2018-12-11
 
CVE-2018-20060

CWE-noinfo
 
 
urllib3 before version 1.23 does not remove the Authorization HTTP header when following a cross-origin redirect (i.e., a redirect that differs in host, port, or scheme). This can allow for credentials in the Authorization header to be exposed to unintended hosts or transmitted in cleartext.

 
2017-01-11
 
CVE-2016-9015

 
 
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.

 

 >>> Vendor: Python 28 Produkty
Python
Virtualenv
Beaker
Keyring
PIP
Setuptools
RPLY
Pyxdg
Pillow
Python-gnupg
Requests
Tgcaptcha2
Python priority library
Hpack
Hyper
Urllib3
Openpyxl
Tablib
Simplejson
Pykerberos
Pypiserver
RSA
Novajoin
Pyxml
Typed ast
Py-bcrypt
Jw.util
Pybluemonday

Copyright 2024, cxsecurity.com

 

Back to Top