{"id":"CVE-2021-28363","aliases":["ALPINE-CVE-2021-28363","BELL-CVE-2021-28363","DEBIAN-CVE-2021-28363","EUVD-2021-0457","GHSA-5phf-pp7p-vc2r","MGASA-2021-0371","MGASA-2021-0377","PYSEC-2021-59","RHBA-2021:1147","ROOT-APP-PYPI-CVE-2021-28363"],"status":"published","title":"Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection","description":"The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02166,"percentile":0.82511,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-295"],"published":"2021-03-15T00:00:00Z","modified":"2026-10-23T17:17:56Z","fixes":[{"ecosystem":"PyPI","package":"urllib3","fixed_in":["1.26.4"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.14","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.15","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-urllib3","fixed_in":["1.26.4-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"python-urllib3","fixed_in":["1.26.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"python-urllib3","fixed_in":["1.26.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"python-urllib3","fixed_in":["1.26.4-1"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"python-urllib3","fixed_in":["1:1.24.3-2.el7"],"sources":["osv"]},{"ecosystem":"Red Hat:openshift:3.11::el7","package":"python2-urllib3","fixed_in":["1:1.24.3-2.el7"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"rootio-urllib3","fixed_in":["1.26.1+root.io.1","1.26.1+root.io.2","1.26.1+root.io.3","1.26.3+root.io.3","1.26.0+root.io.4","1.26.1+root.io.4","1.26.2+root.io.5","1.26.3+root.io.4","1.26.0+root.io.5","1.26.1+root.io.5","1.26.2+root.io.6","1.26.0+root.io.6","1.26.1+root.io.6","1.26.0+root.io.7","1.26.3+root.io.5","1.26.2+root.io.7"],"sources":["osv"]},{"ecosystem":"Root:PyPI","package":"urllib3","fixed_in":["1.26.1+aikido.6","1.26.0+aikido.7","1.26.3+aikido.5","1.26.2+aikido.7"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"fixed":"1.26.4"}]}]},{"source":"osv","ecosystem":"Alpine:v3.14","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.15","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.4-1"}]}]},{"source":"osv","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"fixed":"1.26.4"}]}],"versions":["1.26.0","1.26.1","1.26.2","1.26.3"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-pip","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"20.3.3-3.3.mga8"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:8","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.5-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"PyPI","package":"urllib3","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0"}]},{"type":"ECOSYSTEM","events":[{"introduced":"1.26.0"},{"fixed":"1.26.4"}]}],"versions":["1.26.0","1.26.1","1.26.2","1.26.3"]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.24.3-2.el7"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"python2-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.24.3-2.el7"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"rootio-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1+root.io.1"},{"fixed":"1.26.1+root.io.2"},{"fixed":"1.26.1+root.io.3"},{"fixed":"1.26.3+root.io.3"},{"fixed":"1.26.0+root.io.4"},{"fixed":"1.26.1+root.io.4"},{"fixed":"1.26.2+root.io.5"},{"fixed":"1.26.3+root.io.4"},{"fixed":"1.26.0+root.io.5"},{"fixed":"1.26.1+root.io.5"},{"fixed":"1.26.2+root.io.6"},{"fixed":"1.26.0+root.io.6"},{"fixed":"1.26.1+root.io.6"},{"fixed":"1.26.0+root.io.7"},{"fixed":"1.26.3+root.io.5"},{"fixed":"1.26.2+root.io.7"}]}]},{"source":"osv","ecosystem":"Root:PyPI","package":"urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.26.1+aikido.6"},{"fixed":"1.26.0+aikido.7"},{"fixed":"1.26.3+aikido.5"},{"fixed":"1.26.2+aikido.7"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"peoplesoft_enterprise_peopletools"},{"vendor":"python","product":"urllib3"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518-4 pn/dp mfp"},{"vendor":"siemens","product":"simatic s7-1500 cpu 1518f-4 pn/dp mfp"},{"vendor":"siemens","product":"siplus s7-1500 cpu 1518-4 pn/dp mfp"}],"references":[{"url":"https://github.com/urllib3/urllib3/commits/main","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/","tags":["vendor-advisory","x_transferred","web"]},{"url":"https://security.gentoo.org/glsa/202107-36","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2021.html","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://pypi.org/project/urllib3/1.26.4/","tags":["x_transferred","Third Party Advisory","advisory","package"]},{"url":"https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0","tags":["x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r","tags":["x_transferred","Mitigation","Third Party Advisory","advisory","web"]},{"url":"https://security.gentoo.org/glsa/202305-02","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0007/","tags":["x_transferred","advisory"]},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-398330.html","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-28363","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/releases/tag/1.26.4","tags":["web"]},{"url":"https://github.com/urllib3/urllib3/blob/main/CHANGES.rst#1264-2021-03-15","tags":["web"]},{"url":"https://github.com/pypa/advisory-db/tree/main/vulns/urllib3/PYSEC-2021-59.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL","tags":["web"]},{"url":"https://pypi.org/project/urllib3/1.26.4","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20240621-0007","tags":["web"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2021-59.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-5phf-pp7p-vc2r"},{"url":"https://security.alpinelinux.org/vuln/CVE-2021-28363","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2021-28363","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-28363","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2021-0371.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29010","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=29041","tags":["report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/3L3JUBMPJJ7WYXI6JHX6KKYPPX676PR6/","tags":["web"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2021-July/009129.html","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2021-0377.html","tags":["advisory"]},{"url":"https://github.com/urllib3/urllib3/releases/tag/1.26.3","tags":["web"]},{"url":"https://github.com/urllib3/urllib3/releases/tag/1.26.5","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/NYARUF6IH56FOIKBV7PTO7AXODL5GKNT/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/FMUGWEAUYGGHTPPXT6YBD53WYXQGVV73/","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/JWEE334W43EIJUKSMQSEH6ML7VU57K5B/","tags":["web"]},{"url":"https://access.redhat.com/errata/RHBA-2021:1147","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1918568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1939961","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhba-2021_1147.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-28363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1945136","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-28363","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2021-28363","description":"The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.","status":"published","published":"2021-03-15T00:00:00Z","modified":"2026-10-14T11:39:31.637Z","updated_at":"2026-11-02T14:33:08.811269Z"}],"euvd":[{"id":"EUVD-2021-0457","description":"The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.","status":"published","published":"2021-03-15T00:00:00Z","modified":"2026-10-14T11:39:31Z","updated_at":"2026-11-02T17:27:16.356399Z"}],"ghsa":[{"id":"GHSA-5phf-pp7p-vc2r","title":"Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection","description":"### Impact\n\nUsers who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via `proxy_config`.\nOnly the default SSLContext is impacted.\n\n### Patches\n\n[urllib3 \u003e=1.26.4 has the issue resolved](https://github.com/urllib3/urllib3/releases/tag/1.26.4). urllib3\u003c1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.\n\n### Workarounds\n\nUpgrading is recommended as this is a minor release and not likely to break current usage.\n\nConfiguring an `SSLContext` with `check_hostname=True` and passing via `proxy_config` instead of relying on the default `SSLContext`\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)","status":"published","published":"2021-03-19T19:42:11Z","modified":"2024-11-18T22:42:41Z","cvss":[{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:38:20.833758Z"}],"nvd":[{"id":"CVE-2021-28363","description":"The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.","status":"published","published":"2021-03-15T18:15:19.017Z","modified":"2026-10-14T12:17:11.087Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":6.4,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T14:06:50.805771Z"}],"osv":[{"id":"ALPINE-CVE-2021-28363","description":"The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.","status":"published","published":"2021-03-15T18:15:19.017Z","modified":"2026-10-23T17:17:56.168415771Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:27:48.646074Z"},{"id":"BELL-CVE-2021-28363","title":"CVE-2021-28363 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:51.601889Z","modified":"2026-01-26T09:48:38.561525Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:15.925958Z"},{"id":"CVE-2021-28363","description":"The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.","status":"published","published":"2021-03-15T18:15:19.017Z","modified":"2026-10-20T10:53:41.854964505Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:19.129331Z"},{"id":"DEBIAN-CVE-2021-28363","description":"The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.","status":"published","published":"2021-03-15T18:15:19.017Z","modified":"2026-10-15T09:47:33.633200761Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.94143Z"},{"id":"GHSA-5phf-pp7p-vc2r","title":"Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection","description":"### Impact\n\nUsers who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via `proxy_config`.\nOnly the default SSLContext is impacted.\n\n### Patches\n\n[urllib3 \u003e=1.26.4 has the issue resolved](https://github.com/urllib3/urllib3/releases/tag/1.26.4). urllib3\u003c1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.\n\n### Workarounds\n\nUpgrading is recommended as this is a minor release and not likely to break current usage.\n\nConfiguring an `SSLContext` with `check_hostname=True` and passing via `proxy_config` instead of relying on the default `SSLContext`\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Email us at [sethmichaellarson@gmail.com](mailto:sethmichaellarson@gmail.com)","status":"published","published":"2021-03-19T19:42:11Z","modified":"2026-07-08T06:28:26.820684687Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":6.9,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-295"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"RHBA-2021:1147","title":"Red Hat Bug Fix Advisory: OpenShift Container Platform 3.11.420 bug fix and enhancement update","status":"published","published":"2024-09-14T00:40:02Z","modified":"2026-10-15T10:01:42Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:58.636919Z"},{"id":"MGASA-2021-0371","title":"Updated python-pip packages fix security vulnerabilities","description":"A flaw was found in python-pip in the way it handled Unicode separators in git\nreferences. A remote attacker could possibly use this issue to install a\ndifferent revision on a repository (CVE-2021-3572).\n\nThe bundled python-urllib3 was also vulnerable to:\nThe urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate\nvalidation in some cases involving HTTPS to HTTPS proxies. The initial\nconnection to the HTTPS proxy (if an SSLContext isn't given via proxy_config)\ndoesn't verify the hostname of the certificate. This means certificates for\ndifferent servers that still validate properly with the default urllib3\nSSLContext will be silently accepted (CVE-2021-28363).\n\nAn issue was discovered in urllib3 before 1.26.5. When provided with a URL\ncontaining many @ characters in the authority component, the authority regular\nexpression exhibits catastrophic backtracking, causing a denial of service if a\nURL were passed as a parameter or redirected to via an HTTP redirect\n(CVE-2021-33503).\n","status":"published","published":"2021-07-25T14:45:06Z","modified":"2026-04-16T04:44:03.451454934Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"MGASA-2021-0377","title":"Updated python-urllib3 package fixes security vulnerabilities","description":"The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate\nvalidation in some cases involving HTTPS to HTTPS proxies. The initial\nconnection to the HTTPS proxy (if an SSLContext isn't given via proxy_config)\ndoesn't verify the hostname of the certificate. This means certificates for\ndifferent servers that still validate properly with the default urllib3\nSSLContext will be silently accepted (CVE-2021-28363).\n\nAn issue was discovered in urllib3 before 1.26.5. When provided with a URL\ncontaining many @ characters in the authority component, the authority regular\nexpression exhibits catastrophic backtracking, causing a denial of service if\na URL were passed as a parameter or redirected to via an HTTP redirect\n(CVE-2021-33503).\n","status":"published","published":"2021-07-27T20:21:53Z","modified":"2026-04-16T04:42:49.897684504Z","updated_at":"2026-11-02T15:49:41.509337Z"},{"id":"PYSEC-2021-59","description":"The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.","status":"published","published":"2021-03-15T18:15:00Z","modified":"2023-11-08T04:05:29.804412Z","updated_at":"2026-11-02T15:52:53.119977Z"},{"id":"ROOT-APP-PYPI-CVE-2021-28363","title":"CVE-2021-28363 in rootio-urllib3 - Patched by Root","description":"Root has patched CVE-2021-28363 in the rootio-urllib3 package for Root:PyPI. Multiple fixed versions available.","status":"published","published":"2026-06-03T19:06:45Z","modified":"2026-06-04T02:00:24.998441365Z","updated_at":"2026-11-02T15:53:27.940619Z"}]}}