DEBIAN-CVE-2019-11324

DEBIAN-CVE-2019-11324 PUBLISHED CVSS 7.5 HIGH

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

Risk Scores

CVSS 3.0

7.5

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected Products

Vendor	Product	Versions
Debian:13	python-urllib3	0, 0, 0
Debian:11	python-urllib3	0, 0, 0
Debian:12	python-urllib3	0, 0, 0
Debian:14	python-urllib3	0, 0, 0

Timeline

Apr 18, 2019 CVE Published
Apr 28, 2026 CVE Updated

References

https://security-tracker.debian.org/tracker/CVE-2019-11324 advisory

Open in Interactive Console →