CVE-2016-9015
Urllib3 Incorrect Certificate Validation
CVE-2016-9015 is a low vulnerability (CVSS 3.7) in Python Urllib3, published January 11, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.75%, the 55th percentile. Fixed in urllib3 1.18.1.
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
- Record
CVE-2016-9015- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 2.6 Low
AV:N/AC:H/Au:N/C:P/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
CVE List No score
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
- Record
CVE-2016-9015- Updated
- 2026-11-02
EUVDEUVD-2017-0139 No score
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
- Record
EUVD-2017-0139- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v4w5-p2hg-8fh6
Urllib3 Incorrect Certificate Validation
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
- Record
GHSA-v4w5-p2hg-8fh6- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
OSV
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
- Record
CVE-2016-9015- CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-v4w5-p2hg-8fh6
Urllib3 Incorrect Certificate Validation
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
- Record
GHSA-v4w5-p2hg-8fh6- CVSS 4.0
- 6.3 Medium
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N - CVSS 3.0
- 3.7 Low
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-295
- Updated
- 2026-11-02
Show 11 moreShow less
OSVopenSUSE-SU-2024:10540-1 No score
python3-urllib3-1.18.1-1.2 on GA media
These are all security issues fixed in the python3-urllib3-1.18.1-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10540-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11277-1 No score
python36-urllib3-1.26.6-1.2 on GA media
These are all security issues fixed in the python36-urllib3-1.26.6-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11277-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12944-1 No score
python310-urllib3_1-1.26.15-1.1 on GA media
These are all security issues fixed in the python310-urllib3_1-1.26.15-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12944-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14055-1 No score
python310-urllib3-2.1.0-3.1 on GA media
These are all security issues fixed in the python310-urllib3-2.1.0-3.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14055-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12044-1 No score
python313-urllib3-2.8.0-1.1 on GA media
These are all security issues fixed in the python313-urllib3-2.8.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12044-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:12045-1 No score
python313-urllib3_1-1.26.20-7.2 on GA media
These are all security issues fixed in the python313-urllib3_1-1.26.20-7.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:12045-1- Updated
- 2026-11-02
OSVPYSEC-2017-98 No score
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
- Record
PYSEC-2017-98- Updated
- 2026-11-02
OSVSUSE-FU-2022:0444-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Track already fixed issues.
- Record
SUSE-FU-2022:0444-1- Updated
- 2026-11-02
OSVSUSE-FU-2022:0445-1 No score
Feature update for venv-salt-minion
This feature update for venv-salt-minion provides the following changes:
- Introduce
venv-salt-minion. - Mention fixed issues provided with the bundle.
- Record
SUSE-FU-2022:0445-1- Updated
- 2026-11-02
OSVSUSE-RU-2019:2627-1 No score
Recommended update for python-setuptools and dependend packages
All changes necessary for upgrade of python-setuptools to 40.6.2 (bsc#1075812)
New packages:
- python-cachetools
- python-google-auth
- python-packaging
Rebuilt without source changes:
- python-cffi
- python-cliff
- python-mock
- python-oauthlib
- python-pbr
- python-PyJWT
- python-pytest
Added python3 packages:
- python-hgtools
- python-pyasn1-modules
- python-rsa
Updated:
-
python-kubernetes Updated to version 6.0
-
python-pyparsing
Was updated to version 2.2.0.
-
python-setuptools
Was upgraded to version 40.6.2.
- Record
SUSE-RU-2019:2627-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0139-1 No score
Security update for python-urllib3
This update for python-urllib3 fixes the following issues:
python-urllib3 was updated to version 1.22 (fate#326733, bsc#1110422) and contains new features and lots of bugfixes:
The full changelog can be found on:
https://github.com/Lukasa/urllib3/blob/1.22/CHANGES.rst
Security issues fixed:
- CVE-2016-9015: TLS certificate validation vulnerability (bsc#1024540). (This issue did not affect our previous version 1.16.)
Non security issues fixed:
- bsc#1074247: Fix test suite, use correct date (gh#shazow/urllib3#1303).
- Record
SUSE-SU-2019:0139-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
urllib3PyPI |
1.17 to 1.18 | 1.18.1 |
urllib3PyPI |
1.17 up to 1.18.1, plus listed versions 1.18 |
1.18.1 |
python-oauthlibSUSE:HPE Helion OpenStack 8 |
before 0.7.2-3.9.20 | 0.7.2-3.9.20 |
python-PyJWTSUSE:OpenStack Cloud 7 |
before 1.4.2-3.10.27 | 1.4.2-3.10.27 |
python-oauthlibSUSE:OpenStack Cloud 7 |
before 0.7.2-3.9.20 | 0.7.2-3.9.20 |
python-rsaSUSE:OpenStack Cloud 7 |
before 3.1.4-12.9.17 | 3.1.4-12.9.17 |
python-setuptoolsSUSE:OpenStack Cloud 7 |
before 40.6.2-4.12.23 | 40.6.2-4.12.23 |
python-oauthlibSUSE:OpenStack Cloud 8 |
before 0.7.2-3.9.20 | 0.7.2-3.9.20 |
python-oauthlibSUSE:OpenStack Cloud Crowbar 8 |
before 0.7.2-3.9.20 | 0.7.2-3.9.20 |
python-setuptoolsSUSE:Linux Enterprise Desktop 12 SP4 |
before 40.6.2-4.12.23 | 40.6.2-4.12.23 |
Show 27 moreShow less
| Package | Affected | Fixed |
|---|---|---|
python-setuptoolsSUSE:Linux Enterprise Module for Containers 12 |
before 40.6.2-4.12.23 | 40.6.2-4.12.23 |
python-PyJWTSUSE:Linux Enterprise Module for Public Cloud 12 |
before 1.4.2-3.10.27 | 1.4.2-3.10.27 |
python-cliffSUSE:Linux Enterprise Module for Public Cloud 12 |
before 1.14.0-11.3.2 | 1.14.0-11.3.2 |
python-mockSUSE:Linux Enterprise Module for Public Cloud 12 |
before 2.0.0-3.7.25 | 2.0.0-3.7.25 |
python-oauthlibSUSE:Linux Enterprise Module for Public Cloud 12 |
before 0.7.2-3.9.20 | 0.7.2-3.9.20 |
python-pbrSUSE:Linux Enterprise Module for Public Cloud 12 |
before 3.1.1-3.5.2 | 3.1.1-3.5.2 |
python-rsaSUSE:Linux Enterprise Module for Public Cloud 12 |
before 3.1.4-12.9.17 | 3.1.4-12.9.17 |
python-setuptoolsSUSE:Linux Enterprise Module for Public Cloud 12 |
before 40.6.2-4.12.23 | 40.6.2-4.12.23 |
python-stevedoreSUSE:Linux Enterprise Module for Public Cloud 12 |
before 1.8.0-16.2.1 | 1.8.0-16.2.1 |
python-setuptoolsSUSE:Linux Enterprise Software Development Kit 12 SP4 |
before 40.6.2-4.12.23 | 40.6.2-4.12.23 |
python-setuptoolsSUSE:Linux Enterprise Server 12 SP4 |
before 40.6.2-4.12.23 | 40.6.2-4.12.23 |
python-setuptoolsSUSE:Linux Enterprise Server for SAP Applications 12 SP4 |
before 40.6.2-4.12.23 | 40.6.2-4.12.23 |
python-PyJWTSUSE:Manager Server 3.2 |
before 1.4.2-3.10.27 | 1.4.2-3.10.27 |
python-oauthlibSUSE:Manager Server 3.2 |
before 0.7.2-3.9.20 | 0.7.2-3.9.20 |
python-rsaSUSE:Manager Server 3.2 |
before 3.1.4-12.9.17 | 3.1.4-12.9.17 |
python-rsaSUSE:Enterprise Storage 4 |
before 3.1.4-12.9.17 | 3.1.4-12.9.17 |
python-rsaSUSE:Enterprise Storage 5 |
before 3.1.4-12.9.17 | 3.1.4-12.9.17 |
python-urllib3SUSE:Linux Enterprise Module for Public Cloud 12 |
before 1.22-3.10.1 | 1.22-3.10.1 |
python-urllib3SUSE:Manager Server 3.1 |
before 1.22-3.10.1 | 1.22-3.10.1 |
python-urllib3SUSE:Manager Server 3.2 |
before 1.22-3.10.1 | 1.22-3.10.1 |
python-urllib3SUSE:Enterprise Storage 4 |
before 1.22-3.10.1 | 1.22-3.10.1 |
python-urllib3SUSE:Enterprise Storage 5 |
before 1.22-3.10.1 | 1.22-3.10.1 |
python3-urllib3openSUSE:Tumbleweed |
before 1.18.1-1.2 | 1.18.1-1.2 |
python-urllib3openSUSE:Tumbleweed |
before 1.26.6-1.2 | 1.26.6-1.2 |
python-urllib3openSUSE:Tumbleweed |
before 2.1.0-3.1 | 2.1.0-3.1 |
python-urllib3openSUSE:Tumbleweed |
before 2.8.0-1.1 | 2.8.0-1.1 |
python-urllib3_1openSUSE:Tumbleweed |
before 1.26.20-7.2 | 1.26.20-7.2 |
History
| When | Changed | Sources |
|---|---|---|
| 2026-11-03 | aliases | EUVD |
| 2026-11-02 | created | CVE List, GitHub Advisories, NVD, OSV |
References
securityfocus.com/bid/93941
openwall.com/lists/oss-security/2016/10/27/6
nvd.nist.gov/vuln/detail/CVE-2016-9015
web.archive.org/web/20210123184150/http://www.securityfocus.com/bid/93941
github.com/urllib3/urllib3/commit/c32cdbc16a9634fa0f8c829d1270301570158715
Show 194 moreShow less
suse.com/support/update/announcement/-2022-444/suse-fu-20220444-1
bugzilla.suse.com/1000080
Left out here: 489 references. The JSON record has them.