~ / search / GHSA-5phf-pp7p-vc2r

GHSA-5phf-pp7p-vc2r

Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-28363

Packages

EcosystemPackageAffectedFixed in
PyPI urllib3 >= 1.26.0, < 1.26.4 1.26.4

Details

As written in the advisory (Markdown source, shown as plain text).

### Impact Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via `proxy_config`. Only the default SSLContext is impacted. ### Patches [urllib3 >=1.26.4 has the issue resolved](https://github.com/urllib3/urllib3/releases/tag/1.26.4). urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies. ### Workarounds Upgrading is recommended as this is a minor release and not likely to break current usage. Configuring an `SSLContext` with `check_hostname=True` and passing via `proxy_config` instead of relying on the default `SSLContext` ### For more information If you have any questions or comments about this advisory: * Email us at [[email protected]](mailto:[email protected])

References

External links from the advisory. They lead to third-party sites.