[Python-modules-team] Bug#927412: python-urllib3: CVE-2019-11324: adds system certificates to ssl_context
carnil at debian.org
Fri Apr 19 09:24:54 BST 2019
Tags: security upstream
The following vulnerability was published for python-urllib3,
additionally to the one already reported in the BTS earlier. It was
posted at .
| The urllib3 library before 1.24.2 for Python mishandles certain cases
| where the desired set of CA certificates is different from the OS
| store of CA certificates, which results in SSL connections succeeding
| in situations where a verification failure is the correct outcome.
| This is related to use of the ssl_context, ca_certs, or ca_certs_dir
If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
For further information see:
Please adjust the affected versions in the BTS as needed.
More information about the Python-modules-team