EIQ-2019-0022

EIQ-2019-0022

CVE-2019-11324

SSL connection with improper authentication in urllib3 versions 1.24.1 and earlier

22 Apr 2019

3 - HIGH

7.5

2.4.0

The CA certificate handler component in the urllib3 library versions 1.24.1 and earlier incorrectly handles cases when the desired CA certificates do not match the corresponding CA certificates in the system certificate store.
urllib3 could enable weak/improper authentication by validating a system CA certificate, even if a user-provided CA certificate is explicitly requested and made available for this purpose.

Because of weak/improper authentication, it could be possible to initiate a SSL connection, when it would normally not be allowed because of verification failure.
This could enable an attacker to carry out a man-in-the-middle (MITM) attack, where they could bypass CA authentication by using a certificate signed by an authority recognized by the OS – the system CA – instead of the user-provided CA.

An attacker could exploit this vulnerability by manipulating the ssl_context, ca_certs, or ca_certs_dir arguments with unknown input.

Upgrade urllib3 to version 1.24.2 or later.

2.3.4 and earlier.

For more information, see:

• GitHub diff view with the changes introduced by the fix