Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in
    certain configurations, to not correctly validate TLS certificates. This places users of the library with
    those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability
    affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL
    support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via
    PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is
    low. (CVE-2016-9015)

This update for python-urllib3 fixes the following issues :

python-urllib3 was updated to version 1.22 (fate#326733, bsc#1110422) and contains new features and lots of bugfixes :

The full changelog can be found on :

https://github.com/Lukasa/urllib3/blob/1.22/CHANGES.rst

Security issues fixed :

  - CVE-2016-9015: TLS certificate validation vulnerability     (bsc#1024540). (This issue did not affect our previous     version 1.16.)

Non security issues fixed :

  - bsc#1074247: Fix test suite, use correct date     (gh#shazow/urllib3#1303).

This update was imported from the SUSE:SLE-12-SP1:Update update project.

urllib3 reports :

CVE-2016-9015: Certification verification failure

ID	Name	Product	Family	Type	Severity
434854	SCA: security update for urllib3 (GHSA-v4w5-p2hg-8fh6)	Tenable Cloud Security	SCA Checks	Local	medium
434854	SCA: security update for urllib3 (GHSA-v4w5-p2hg-8fh6)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
122144	openSUSE Security Update : python-urllib3 (openSUSE-2019-159)	Nessus	SuSE Local Security Checks	Local	low
94346	FreeBSD : urllib3 -- certificate verification failure (c5c6e293-9cc7-11e6-823f-b8aeed92ecc4)	Nessus	FreeBSD Local Security Checks	Local	low

Detections

Analytics

CVE-2016-9015

medium

Tenable Plugins

medium

medium

low

low