CVE-2021-28363: Medium severity red hat python3-urllib3 vulnerability
Impact
Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via proxyconfig. Only the default SSLContext is impacted.
Patches
urllib3 >=1.26.4 has the issue resolved. urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.
Workarounds
Upgrading is recommended as this is a minor release and not likely to break current usage.
Configuring an SSLContext with checkhostname=True and passing via proxyconfig instead of relying on the default SSLContext
For more information If you have any questions or comments about this advisory: Email us at sethmichaellarson@gmail.com
Other sources
The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxyconfig) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.
urllib3 for python is vulnerable to a man-in-the-middle attack, caused by improper certificate validation in some cases involving HTTPS to HTTPS proxies. An attacker could exploit this vulnerability to launch a man-in-the-middle attack and gain access to the communication channel between endpoints to obtain sensitive information or further compromise the system.
— IBM
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-28363?
CVE-2021-28363 is a vulnerability in the urllib3 library for Python that allows SSL certificate validation to be omitted in some cases involving HTTPS to HTTPS proxies.
What is the severity of CVE-2021-28363?
The severity of CVE-2021-28363 is medium with a CVSS score of 6.5.
Which software versions are affected by CVE-2021-28363?
The Python urllib3 library versions 1.26.0 to 1.26.3 are affected by CVE-2021-28363.
How does CVE-2021-28363 impact Oracle PeopleSoft Enterprise PeopleTools?
Oracle PeopleSoft Enterprise PeopleTools version 8.59 is affected by CVE-2021-28363.
How do I fix CVE-2021-28363?
To fix CVE-2021-28363, upgrade to urllib3 version 1.26.4 for Python or a later stable release.