{"id":"CVE-2019-11324","published":"2019-04-18T00:00:00Z","modified":"2024-08-04T22:48:09Z","title":"The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is…","vendor":null,"product":null,"tier":"tail","description":{"text":"The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.02915,"percentile":0.86993,"provenance":"source"},"cwes":[],"references":[{"url":"https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2019/04/19/1","tags":["mailing-list"]},{"url":"https://usn.ubuntu.com/3990-1/","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html","tags":["vendor-advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html","tags":["vendor-advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3590","tags":["vendor-advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2019:3335","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/","tags":["vendor-advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/","tags":["vendor-advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html","tags":["mailing-list"]},{"url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html","tags":["mailing-list"]}],"priority":{"score":17.4,"factors":[{"name":"EPSS percentile","points":17.4}]},"affected":[{"ecosystem":"PyPI","package":"urllib3","vulnerableRanges":["<1.24.2"],"patched":["1.24.2"],"from":["GHSA-mh33-7rrq-662w","PYSEC-2019-133"],"provenance":"source"}],"euvd":{"id":"EUVD-2019-0153","exploited":false,"provenance":"source"},"lineage":{"familyId":"fam-urllib3-cve-2018-20060","children":[{"from":"CVE-2019-11324","to":"CVE-2018-25091","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/urllib3/poolmanager.py","src/urllib3/util/retry.py"],"commits":["https://github.com/urllib3/urllib3/commit/adb358f8e06865406d1f05e581a16cbea2136fbc","https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1"],"basis":"shared function","functions":["__init__","urlopen"]}]},{"from":"CVE-2019-11324","to":"CVE-2021-33503","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/urllib3/util/ssl_.py"],"commits":["https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1","https://github.com/urllib3/urllib3/commit/2d4a3fee6de2fa45eb82169361918f759269b4ec","https://github.com/urllib3/urllib3/commit/5b047b645f5f93900d5e2fc31230848c25eb1f5f"],"basis":"rarely changed file"}]},{"from":"CVE-2019-11324","to":"CVE-2023-45803","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/urllib3/poolmanager.py"],"commits":["https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1","https://github.com/urllib3/urllib3/commit/4e98d57809dacab1cbe625fddeec1a290c478ea9","https://github.com/urllib3/urllib3/commit/4e50fbc5db74e32cabd5ccc1ab81fc103adfe0b3"],"basis":"shared function","functions":["urlopen"]}]},{"from":"CVE-2019-11324","to":"CVE-2025-50181","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"same-code","provenance":"machine","files":["src/urllib3/poolmanager.py"],"commits":["https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1","https://github.com/urllib3/urllib3/commit/f05b1329126d5be6de501f9d1e3e36738bc08857"],"basis":"shared function","functions":["urlopen"]}]}],"packageHistory":[{"cve":"CVE-2016-9015","published":"2017-01-11","fixed":"1.18.1","kev":false},{"cve":"CVE-2018-20060","published":"2018-12-11","fixed":"1.23","kev":false,"link":{"from":"CVE-2018-20060","to":"CVE-2019-11324","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:urllib3","fromFixed":"1.23","toFixed":"1.24.2","daysApart":128}]}},{"cve":"CVE-2018-25091","published":"2023-10-15","fixed":"1.24.2","kev":false},{"cve":"CVE-2019-11324","published":"2019-04-18","fixed":"1.24.2","kev":false},{"cve":"CVE-2019-11236","published":"2019-04-15","fixed":"1.24.3","kev":false,"link":{"from":"CVE-2019-11324","to":"CVE-2019-11236","relation":"successor","confidence":"low","kind":"sequence","orderedBy":"description","evidence":[{"kind":"version-step","provenance":"source","package":"PyPI:urllib3","fromFixed":"1.24.2","toFixed":"1.24.3","daysApart":-3}]}},{"cve":"CVE-2020-7212","published":"2020-03-06","fixed":"1.25.8","kev":false},{"cve":"CVE-2020-26137","published":"2020-09-29","fixed":"1.25.9","kev":false}],"package":"PyPI:urllib3"}}