Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection

MEDIUM 6.5CVE-2021-28363 · GHSA-5phf-pp7p-vc2r · PYSEC-2021-59 · Published 15/03/2021 · updated 14/10/2026

Package	Affected versions	Patched versions
urllib3 PyPI	`≥ 1.26.0, < 1.26.4`	`1.26.4`
peoplesoft enterprise peopletools oracle	`= 8.59`	No fix yet
urllib3 python	`≥ 1.26.0, < 1.26.4`	`1.26.4`

Description

Impact

Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via proxy_config. Only the default SSLContext is impacted.

Patches

urllib3 >=1.26.4 has the issue resolved. urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.

Workarounds

Upgrading is recommended as this is a minor release and not likely to break current usage.

Configuring an SSLContext with check_hostname=True and passing via proxy_config instead of relying on the default SSLContext

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

NVD description

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

References

urllib3/urllib3 security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2021-28363 · ADVISORY
urllib3/urllib3 commit 8d65ea1 · WEB
pypa/advisory-database · WEB
pypa/advisory-db · WEB
urllib3/urllib3 · PACKAGE
urllib3/urllib3 · WEB
urllib3/urllib3 · WEB
urllib3/urllib3 release 1.26.4 · WEB
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL · WEB
lists.fedoraproject.org/archives/list/[email protected]/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

urllib3

PyPI

≥ 1.26.0, < 1.26.4

1.26.4

peoplesoft enterprise peopletools

oracle

= 8.59

No fix yet

urllib3

python

≥ 1.26.0, < 1.26.4

1.26.4

Description

Impact

Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via proxy_config. Only the default SSLContext is impacted.

Patches

urllib3 >=1.26.4 has the issue resolved. urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.

Workarounds

Upgrading is recommended as this is a minor release and not likely to break current usage.

Configuring an SSLContext with check_hostname=True and passing via proxy_config instead of relying on the default SSLContext

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

NVD description