Vulnerability Description
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Python | Urllib3 | < 1.24.2 |
| Canonical | Ubuntu Linux | 16.04 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html
- http://www.openwall.com/lists/oss-security/2019/04/19/1Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3335
- https://access.redhat.com/errata/RHSA-2019:3590
- https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4PatchThird Party Advisory
- https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
- https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://usn.ubuntu.com/3990-1/Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
- http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html
- http://www.openwall.com/lists/oss-security/2019/04/19/1Mailing ListThird Party Advisory
- https://access.redhat.com/errata/RHSA-2019:3335
FAQ
What is CVE-2019-11324?
CVE-2019-11324 is a vulnerability with a CVSS score of 7.5 (HIGH). The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succe...
How severe is CVE-2019-11324?
CVE-2019-11324 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-11324?
Check the references section above for vendor advisories and patch information. Affected products include: Python Urllib3, Canonical Ubuntu Linux.