| Name | CVE-2019-11324 |
| Description | The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument. |
| Source | CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DLA-2686-1, DLA-3610-1 |
| Debian Bugs | 927412 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|
| python-urllib3 (PTS) | jessie, jessie (lts) | 1.9.1-3+deb8u2 | fixed |
| stretch (security) | 1.19.1-1+deb9u1 | fixed |
| stretch (lts), stretch | 1.19.1-1+deb9u2 | fixed |
| buster (security), buster, buster (lts) | 1.24.1-1+deb10u2 | fixed |
| bullseye | 1.26.5-1~exp1 | fixed |
| bookworm | 1.26.12-1 | fixed |
| sid, trixie | 2.0.7-2 | fixed |
The information below is based on the following data on fixed versions.
Notes
[jessie] - python-urllib3 <not-affected> (Vulnerable code introduced later)
https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1
https://www.openwall.com/lists/oss-security/2019/04/17/3
[wheezy] - python-urllib3 <not-affected> (Vulnerable code introduced later)