Critical SSL Verification Bypass in urllib3 Package
Summary
CVE-2019-11324: The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations... Affects python-urllib3 across 2 version ranges.
< 1.25.6-4
< 1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1
Fixed in 1.25.6-4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a powerful, user-friendly HTTP client for Python, widely used for making HTTP requests. It provides features such as connection pooling, client-side SSL/TLS verification, and support for various HTTP methods. However, prior to version 1.24.2, urllib3 mishandled certain cases where the desired set of CA certificates differed from the operating system's store, leading to potential SSL verification failures.
Vulnerability Detail
The vulnerability, identified as CVE-2019-11324, arises from improper handling of SSL certificate verification in urllib3 versions before 1.24.2. This flaw allows SSL connections to succeed even when they should fail due to verification issues, potentially exposing users to man-in-the-middle attacks. The problem is linked to the use of the ssl_context, ca_certs, or ca_certs_dir arguments, which can lead to insecure connections if not configured correctly.
How To Fix
Minimum fixed version
1.25.6-4
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python-urllib3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading is not immediately possible, consider using a custom SSL context that enforces stricter verification. This can be done by creating an SSL context in your code as follows:
import ssl import urllib3
Create a custom SSL context
ssl_context = ssl.create_default_context()
ssl_context.verify_mode = ssl.CERT_REQUIRED
Use the custom context in your urllib3 connection
http = urllib3.PoolManager(ssl_context=ssl_context)
Conclusion
CVE-2019-11324 represents a significant security risk for applications using vulnerable versions of urllib3. It is crucial for developers to upgrade to the latest version to ensure secure SSL connections and protect against potential attacks. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for python-urllib3 →
FAQ
CVE-2019-11324 is a vulnerability in the urllib3 library that allows SSL connections to succeed even when they should fail due to certificate verification issues.
You can check if your application is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor and alert for open-source vulnerabilities without any signup.
The primary risk is exposure to man-in-the-middle attacks, where an attacker could intercept and manipulate data being transmitted over SSL connections.
The CVSS score for CVE-2019-11324 is 7.5, indicating a high severity level.
Yes, you can create a custom SSL context that enforces stricter verification as a temporary workaround until you can upgrade.
Related vulnerabilities
Recent vulnerabilities recorded for python-urllib3.
