Urllib3 Incorrect Certificate Validation

published 2017-01-11 9 y ago modified 2026-06-17 4 mo ago also GHSA-v4w5-p2hg-8fh6 , PYSEC-2017-98 , EUVD-2017-0139

cvss: 3.7; version 3.0, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 0.8%; EPSS 0.8% chance of exploitation in 30 days, percentile 55%
public exploits: 0; none known

Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.

Patch / fix

fixed in 1 distros 2 links 1

pypi urllib3 1.18.1

suse opensuse

python-setuptools SLES for SAP 12 SP4, SLES 12 SP4, SLED 12 SP4 +4 more 40.6.2-4.12.23
python-pbr SLE Module for Public Cloud 12 3.1.1-3.5.2
python-rsa SLE Module for Public Cloud 12, OpenStack Cloud 7, Manager Server 3.2 +2 more 3.1.4-12.9.17
python-mock SLE Module for Public Cloud 12 2.0.0-3.7.25
python-cliff SLE Module for Public Cloud 12 1.14.0-11.3.2
python-PyJWT SLE Module for Public Cloud 12, OpenStack Cloud 7, Manager Server 3.2 1.4.2-3.10.27
python-oauthlib SLE Module for Public Cloud 12, OpenStack Cloud Crowbar 8, OpenStack Cloud 8 +3 more 0.7.2-3.9.20
python-stevedore SLE Module for Public Cloud 12 1.8.0-16.2.1

suse advisories SUSE-RU-2019:2627-1 SUSE-SU-2019:0139-1

python-urllib3 openSUSE Tumbleweed 2.8.0-1.1
python-urllib3_1 openSUSE Tumbleweed 1.26.20-7.2
python-urllib3 openSUSE Tumbleweed 2.1.0-3.1
python3-urllib3 openSUSE Tumbleweed 1.18.1-1.2
python-urllib3 openSUSE Tumbleweed 1.26.6-1.2

opensuse advisories openSUSE-SU-2026:12044-1 openSUSE-SU-2026:12045-1 openSUSE-SU-2024:14055-1 openSUSE-SU-2024:10540-1 openSUSE-SU-2024:11277-1

github.com/urllib3/urllib3@c32cdbc commit

Exploit prediction

0.75% chance of exploitation in the next 30 days, higher than 55% of all scored CVEs (FIRST EPSS, 2026-11-09).

CVSS scores

assigned by	version	score	vector
NVD	3.0	3.7	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	2.0	2.6	AV:N/AC:H/Au:N/C:P/I:N/A:N
GitHub	3.0	3.7	CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
pypi	urllib3	>=1.17, <1.18.1	1.18.1

Classification

Weakness

CWE-295 Improper Certificate Validation

References

github.com /urllib3/urllib3/commit/c32cdbc16a9634fa0f8c829d1270301570158715
web
securityfocus.com /bid/93941
vdb-entry, third-party-advisory, web
openwall.com /lists/oss-security/2016/10/27/6
mailing-list, web, mitigation
nvd.nist.gov /vuln/detail/CVE-2016-9015
advisory
github.com /pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2017-98.yaml
web
github.com /urllib3/urllib3
package
web.archive.org /web/20210123184150/http://www.securityfocus.com/bid/93941
web
github.com /advisories/GHSA-v4w5-p2hg-8fh6
advisory

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary