Improper validation of certificate with host mismatch in urllib3 - CVE-2021-28363

Vulnerability identifier: #VU51604

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-28363

CWE-ID: CWE-297

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform MitM attack.

The vulnerability exists due to urllib3 library for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted. A remote attacker can supply a valid SSL certificate for a different hostname and perform Man-in-the-Middle (MitM) attack.

urllib3
IBM Cloud Pak for Watson AIOps
Gentoo Linux
Slackware Linux
Fedora
python-ptyprocess (Red Hat package)
python-lockfile (Red Hat package)
ansible-runner (Red Hat package)
python-urllib3 (Red Hat package)
python-daemon (Red Hat package)
atomic-openshift (Red Hat package)
openshift-ansible (Red Hat package)
atomic-openshift-cluster-autoscaler (Red Hat package)
golang-github-prometheus-alertmanager (Red Hat package)
atomic-openshift-service-idler (Red Hat package)
atomic-openshift-metrics-server (Red Hat package)
atomic-openshift-node-problem-detector (Red Hat package)
openshift-enterprise-autoheal (Red Hat package)
atomic-openshift-web-console (Red Hat package)
atomic-openshift-descheduler (Red Hat package)
openshift-enterprise-cluster-capacity (Red Hat package)
golang-github-openshift-oauth-proxy (Red Hat package)
golang-github-prometheus-node_exporter (Red Hat package)
atomic-enterprise-service-catalog (Red Hat package)
golang-github-prometheus-prometheus (Red Hat package)
atomic-openshift-dockerregistry (Red Hat package)
openshift-kuryr (Red Hat package)
python-pexpect (Red Hat package)
python-psutil (Red Hat package)
python-pip
Spectrum Discover
IBM Watson Assistant for IBM Cloud Pak for Data
IBM Monitor Component
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Red Hat OpenShift Container Platform
IBM Cognos Analytics

Install updates from vendor's website.

urllib3 - update to 1.26.4
python-ptyprocess (Red Hat package) - update to 0.5.2-3.el7at
python-lockfile (Red Hat package) - update to 0.11.0-10.el7at
ansible-runner (Red Hat package) - update to 1.2.0-1.el7ar
python-urllib3 (Red Hat package) - update to 1.24.3-2.el7
Spectrum Discover - addressed in versions 2.0.3.5, 2.0.4.2
python-daemon (Red Hat package) - update to 2.1.2-7.el7at
Red Hat OpenShift Container Platform - update to 3.11.420
atomic-openshift (Red Hat package) - update to 3.11.420-1.git.0.14645d0.el7
openshift-ansible (Red Hat package) - update to 3.11.420-1.git.0.336dcef.el7
atomic-openshift-cluster-autoscaler (Red Hat package) - update to 3.11.420-1.git.0.5eb2514.el7
golang-github-prometheus-alertmanager (Red Hat package) - update to 3.11.420-1.git.0.9300c91.el7
atomic-openshift-service-idler (Red Hat package) - update to 3.11.420-1.git.15.021a26a.el7
atomic-openshift-metrics-server (Red Hat package) - update to 3.11.420-1.git.53.4b2f788.el7
atomic-openshift-node-problem-detector (Red Hat package) - update to 3.11.420-1.git.616.0e0f24d.el7
openshift-enterprise-autoheal (Red Hat package) - update to 3.11.420-1.git.218.439a0dd.el7
atomic-openshift-web-console (Red Hat package) - update to 3.11.420-1.git.693.897d713.el7
atomic-openshift-descheduler (Red Hat package) - update to 3.11.420-1.git.299.1441464.el7
openshift-enterprise-cluster-capacity (Red Hat package) - update to 3.11.420-1.git.379.aa3bf1b.el7
golang-github-openshift-oauth-proxy (Red Hat package) - update to 3.11.420-1.git.439.bfcc32b.el7
golang-github-prometheus-node_exporter (Red Hat package) - update to 3.11.420-1.git.1062.26157c1.el7
atomic-enterprise-service-catalog (Red Hat package) - update to 3.11.420-1.git.1675.fc6e217.el7
golang-github-prometheus-prometheus (Red Hat package) - update to 3.11.420-1.git.5026.1e8cb9c.el7
atomic-openshift-dockerregistry (Red Hat package) - update to 3.11.420-1.git.481.b7f0e25.el7
openshift-kuryr (Red Hat package) - update to 3.11.420-1.git.1500.afe0076.el7
IBM Watson Assistant for IBM Cloud Pak for Data - update to 4.7.0
python-pexpect (Red Hat package) - update to 4.6-1.el7at
IBM Monitor Component - addressed in versions 8.6.3, 8.7.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.3
python-psutil (Red Hat package) - update to 5.4.3-3.el7ar
IBM Cognos Analytics - addressed in versions 11.2.4 FP3, 12.0.3
python-pip - update to 21.0.1-3.fc34

• https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0
• https://github.com/urllib3/urllib3/commits/main
• https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r
• https://pypi.org/project/urllib3/1.26.4/

• MitM-attack in urllib3 library
• MitM attack in Red Hat OpenShift Container Platform
• Gentoo update for urllib3
• Multiple vulnerabilities in IBM Monitor Component
• Slackware Linux update for python3
• Multiple vulnerabilities in IBM Spectrum Discover
• Gentoo update for Python, PyPy3
• Multiple vulnerabilities in IBM Watson Assistant for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cognos Analytics
• Fedora 34 update for python-pip