Improper Certificate Validation in urllib3 - CVE-2019-11324

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU21780

Improper Certificate Validation in urllib3 - CVE-2019-11324

Published: October 15, 2019 / Updated: June 20, 2021


Vulnerability identifier: #VU21780
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-11324
CWE-ID: CWE-295
Exploitation vector: Remote access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to compromise the target system.

The vulnerability exists due to the urllib3 library for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates. A remote attacker can cause the certificates to be considered trusted contrary to expectations. This is related to use of the "ssl_context", "ca_certs" or "ca_certs_dir" argument.

Affected software

urllib3
Amazon Linux AMI
Fedora
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for Scientific Computing
Red Hat Enterprise Linux for Power, big endian
CentOS
Red Hat Enterprise Linux Desktop
Red Hat Enterprise Linux Workstation
Red Hat Enterprise Linux Server
Red Hat Enterprise Linux for IBM z Systems - Extended Update Support
Red Hat Enterprise Linux for Power, big endian - Extended Update Support
Red Hat Enterprise Linux Server - AUS
Red Hat Enterprise Linux EUS Compute Node
Red Hat Enterprise Linux for x86_64 - Extended Update Support
Red Hat Enterprise Linux for Power, little endian - Extended Update Support
Red Hat Enterprise Linux Server - TUS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Opensuse
Dell EMC PowerProtect Data Protection
SmartFabric OS10
SOAR QRadar Plugin App
RecoverPoint for Virtual Machines
python-pip (Red Hat package)
skopeo (Red Hat package)
runc (Red Hat package)
python-urllib3 (Red Hat package)
python3-urllib3
python3-requests
openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
openshift-kuryr (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
machine-config-daemon (Red Hat package)
openshift-clients (Red Hat package)
jenkins-2-plugins (Red Hat package)
python-pip
Red Hat OpenShift Container Platform
IBM Spectrum Symphony

How to mitigate CVE-2019-11324

Install updates from vendor's website.

urllib3 - update to 1.24.2
Dell EMC PowerProtect Data Protection - update to 2.7.8
RecoverPoint for Virtual Machines - update to 6.0 SP2 P1
python-pip (Red Hat package) - addressed in versions 9.0.3-7.el7_7, 9.0.3-7.el7_8, 9.0.3-16.el8
SmartFabric OS10 - addressed in versions 10.5.4.11, 10.5.6.1
skopeo (Red Hat package) - update to 0.1.40-5.rhaos.el8
runc (Red Hat package) - addressed in versions 1.0.0-69.rhaos4.4.git81f3917.el7, 1.0.0-69.rhaos4.4.git81f3917.el8
python-urllib3 (Red Hat package) - addressed in versions 1.24.2-2.el8, 1.24.3-1.el7
python3-urllib3 - update to 1.25.1-1.el7
python3-requests - update to 2.14.2-1.el7
Red Hat OpenShift Container Platform - addressed in versions 4.3.28, 4.4.11
openshift (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.0.3d5309c.el7, 4.3.28-202006270952.p0.git.0.3d5309c.el8, 4.4.0-202006271254.p0.git.0.00954ea.el7, 4.4.0-202006271254.p0.git.0.00954ea.el8
openshift-ansible (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.0.c07ec65.el7, 4.4.0-202006271254.p0.git.0.d256229.el7
atomic-openshift-service-idler (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.13.4a5b28a.el7, 4.4.0-202006271254.p0.git.13.6b09c66.el7
openshift-kuryr (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.1632.9e3ea83.el8, 4.4.0-202006271254.p0.git.1811.c15bfa2.el8
atomic-enterprise-service-catalog (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.1806.b12beb7.el7, 4.4.0-202006271254.p0.git.1806.44e1f58.el7
machine-config-daemon (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.2178.08d8005.el8, 4.4.0-202006271254.p0.git.2337.29601a9.el8
openshift-clients (Red Hat package) - addressed in versions 4.3.28-202006270952.p0.git.3325.7c2f859.el7, 4.3.28-202006270952.p0.git.3325.7c2f859.el8, 4.4.0-202006271254.p0.git.3436.9f4fcab.el7, 4.4.0-202006271254.p0.git.3436.9f4fcab.el8
jenkins-2-plugins (Red Hat package) - update to 4.3.1593080425-1.el7
SOAR QRadar Plugin App - update to 5.4.0
IBM Spectrum Symphony - update to 7.3.2 Fix 601860
python-pip - addressed in versions 19.0.3-6.fc30, 19.1.1-7.fc31

External References

Related Security Bulletins