| Package | Affected versions | Patched versions |
|---|---|---|
| urllib3 | ≥ 1.26.0, < 1.26.4 | 1.26.4 |
| peoplesoft enterprise peopletools | = 8.59 | |
| urllib3 | ≥ 1.26.0, < 1.26.4 | 1.26.4 |
Users who are using an HTTPS proxy to issue HTTPS requests and haven't configured their own SSLContext via proxy_config.
Only the default SSLContext is impacted.
urllib3 >=1.26.4 has the issue resolved. urllib3<1.26 is not impacted due to not supporting HTTPS requests via HTTPS proxies.
Upgrading is recommended as this is a minor release and not likely to break current usage.
Configuring an SSLContext with check_hostname=True and passing via proxy_config instead of relying on the default SSLContext
If you have any questions or comments about this advisory:
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free