未評価
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA ce...
CVE-2019-11324
SecPulse初出
ディストリビューション別の修正状況
各ディストリビューションが公開している、この CVE の修正パッケージ
- Debian DEBIAN-CVE-2019-11324 python-urllib3 修正版: 1.25.6-4
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory openwall.com
- advisory access.redhat.com
- advisory access.redhat.com
- advisory usn.ubuntu.com
- patch github.com
- web lists.opensuse.org
- web lists.opensuse.org
- web lists.debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web lists.fedoraproject.org