CVE-2021-28363

Timeline

Detection, updates, and resolution for this record.

1. Mar 15, 2021 · NIST NVD

   Detected

   The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently a

2. Oct 14, 2026 · NIST NVD

   Updated

   The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently a

Affected

• cpe fedoraproject/fedora34
• cpe oracle/peoplesoft enterprise peopletools8.59
• cpe python/urllib3version unspecified

Sources

• CVE.orgCVE-2021-28363

  Official CVE identifier

  cve.org
• FIRST EPSSCVE-2021-28363

  30-day exploitation probability 2.1%

  first.org
• NIST NVDCVE-2021-28363

  The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This mean

  nvd.nist.gov

References

• Patch · github.com
• Patch · github.com
• Mitigation · github.com
• Reference · lists.fedoraproject.org
• Third Party Advisory · pypi.org
• Third Party Advisory · security.gentoo.org
• Reference · security.gentoo.org
• Reference · security.netapp.com