What’s Vulnerable › Vulnerabilities

CVE-2021-28363

• Severity: medium (CVSS 6.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 2.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-03-15 · updated 2026-10-14
• Weakness: CWE-295

Description

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

Affected products

• Fedoraproject Fedora: 34
• Oracle Corporation PeopleSoft Enterprise PT PeopleTools: 8.59
• urllib3: from 1.26.0 before 1.26.4 — fixed in 1.26.4

How to fix

Upgrade to a fixed version: urllib3 1.26.4. Check the vendor advisory for mitigations.

References

• https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
• https://github.com/urllib3/urllib3/commits/main
• https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL/
• https://pypi.org/project/urllib3/1.26.4/
• https://security.gentoo.org/glsa/202107-36
• https://security.gentoo.org/glsa/202305-02
• https://security.netapp.com/advisory/ntap-20240621-0007/
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
• https://github.com/urllib3/urllib3/commits/main
• https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r

Get alerted when CVE-2021-28363 or the next vulnerability affects your stack