Python 'urllib3' Module SSL Certificate Validation Security Bypass Vulnerability
BID:55458
Info
Python 'urllib3' Module SSL Certificate Validation Security Bypass Vulnerability
| Bugtraq ID: | 55458 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Sep 07 2012 12:00AM |
| Updated: | Sep 07 2012 12:00AM |
| Credit: | Jamie Strandboge |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Python 'urllib3' Module SSL Certificate Validation Security Bypass Vulnerability
The 'urllib3' module for Python is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from the server.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
The 'urllib3' module for Python is prone to a security-bypass vulnerability because the application fails to properly validate SSL certificates from the server.
Successfully exploiting this issue allows attackers to perform man-in-the-middle attacks or impersonate trusted servers, which will aid in further attacks.
Exploit / POC
Python 'urllib3' Module SSL Certificate Validation Security Bypass Vulnerability
An attacker can use readily available network utilities to exploit this issue.
An attacker can use readily available network utilities to exploit this issue.
Solution / Fix
Python 'urllib3' Module SSL Certificate Validation Security Bypass Vulnerability
Solution:
Vendor patch is available. Please see the references for more information.
Solution:
Vendor patch is available. Please see the references for more information.
References
Python 'urllib3' Module SSL Certificate Validation Security Bypass Vulnerability
References:
References:
- CVE Request -- urllib3: Does not check for SSL certificates by default (Jan iankko Lieskovsky)
- urllib3 Homepage (Python Software Foundation)
- python-urllib3 should default to verifying certificates (Jamie Strandboge )