CVE-2019-11324: Improper Certificate Validation in urllib3
Summary
CVE-2019-11324: Improper Certificate Validation in urllib3. Affects urllib3 versions < 1.24.2. Fixed in 1.24.2. How to fix ↓
Also tracked for
- python-urllib3 · Debian:11
The same CVE-2019-11324 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
urllib3 is a Python library that provides a simple interface for making HTTP requests. It is widely used in various Python applications and frameworks. This vulnerability affects urllib3 versions prior to 1.24.2. The library mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates. As a result, SSL connections can succeed even when they should fail due to certificate verification failure.
Vulnerability Detail
The vulnerability arises from the improper handling of the ssl_context, ca_certs, or ca_certs_dir argument in urllib3. When the desired set of CA certificates differs from the OS store of CA certificates, SSL connections can be established even in situations where a verification failure should occur. This can lead to a false sense of security, as connections that should be rejected due to invalid certificates are accepted.
How To Fix
Latest published version: 2.8.0 as of 23 Oct 2026
pip install --upgrade "urllib3==2.8.0"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.24.2
This is the first release that contains the fix.
pip install --upgrade "urllib3==1.24.2"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading urllib3 is not immediately feasible, a possible workaround is to manually validate the SSL certificates in your code. This involves implementing custom certificate validation logic to ensure that connections are only established when the certificates are valid. Here is an example of how to perform certificate validation using the ssl module in Python:
import ssl
import urllib3
# Create a custom SSL context
ssl_context = ssl.create_default_context(cafile='path/to/custom/certificates.pem')
# Create an urllib3 PoolManager with the custom SSL context
http = urllib3.PoolManager(cert_reqs='CERT_REQUIRED', ca_certs='path/to/custom/certificates.pem', ssl_context=ssl_context)
# Make HTTP requests using the PoolManager
response = http.request('GET', 'https://example.com')
Conclusion
In conclusion, the vulnerability in urllib3 (CVE-2019-11324) allows SSL connections to succeed even when certificate verification should fail. It is crucial to upgrade urllib3 to version 1.24.2 or later to fix this issue. If upgrading is not possible immediately, implementing custom certificate validation logic can serve as a temporary workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for urllib3 →
FAQ
urllib3 is a Python library that provides a simple interface for making HTTP requests. It is widely used in various Python applications and frameworks.
Versions of urllib3 prior to 1.24.2 are affected by this vulnerability.
The vulnerability allows SSL connections to succeed even when certificate verification should fail. This can lead to a false sense of security, as connections with invalid certificates are accepted.
To fix this vulnerability, it is recommended to upgrade urllib3 to version 1.24.2 or later.
If upgrading urllib3 is not immediately feasible, a possible workaround is to manually validate SSL certificates in your code.
Related vulnerabilities
Recent vulnerabilities recorded for urllib3.
