Intel

CVE-2019-11324

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS s… (CVE-2019-11324)

highEPSS 2.8%

Description

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

Source: CVELISTV5NVDOSVOSV

Metrics

Severity
high
Priority score
88.99
KEV status
—
Exploit maturity
no public PoC known
XIEM Effective CVSS
7.5
Source: nvd-v3
CVSS v3
7.5
CVSS v4
—
EPSS percentile
85.8 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
2.8 %
Moderate — model estimates 1-10% exploitation likelihood.
Published
2019-04-18 00:00 UTC
CWE
—

Affected operating systems

  • linux

    canonical / ubuntu_linux16.04

  • linux

    canonical / ubuntu_linux18.04

  • linux

    canonical / ubuntu_linux18.10

  • linux

    canonical / ubuntu_linux19.04

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • python

    urllib31.24.2

References & sources

IDCVE-2019-11324