VDB
GHSA-5phf-pp7p-vc2r
GHSA-5phf-pp7p-vc2r
PUBLISHED
CVSS 6.5 MEDIUM
Record from GitHub Advisory Database · Published March 19, 2021
urllib3 is fixed in 1.26.4 (PyPI)
Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| urllib3 | PyPI | 1.26.4 |
Risk scores
CVSS 3.1
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| PyPI | urllib3 | 1.26.0 |
| PyPI | urllib3 | 1.26.0 |
Timeline
- Mar 19, 2021 CVE Published
- Dec 16, 2025 PoC Published
- Mar 20, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln GHSA-5phf-pp7p-vc2r
vulnetix vdb fixes GHSA-5phf-pp7p-vc2rOr with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/GHSA-5phf-pp7p-vc2r/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart
References
- https://security.gentoo.org/glsa/202305-02 url
- https://security.netapp.com/advisory/ntap-20240621-0007 url
- https://github.com/urllib3/urllib3/security/advisories/GHSA-5phf-pp7p-vc2r url
- https://github.com/pypa/advisory-db/tree/main/vulns/urllib3/PYSEC-2021-59.yaml url
- GitHub Advisory GHSA-5phf-pp7p-vc2r vendor-advisory
- https://github.com/urllib3/urllib3/commits/main url
- https://nvd.nist.gov/vuln/detail/CVE-2021-28363 advisory
- https://github.com/urllib3/urllib3/commit/8d65ea1ecf6e2cdc27d42124e587c1b83a3118b0 url
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL url
- https://security.gentoo.org/glsa/202107-36 url
- https://www.oracle.com/security-alerts/cpuoct2021.html url
- https://github.com/pypa/advisory-database/tree/main/vulns/urllib3/PYSEC-2021-59.yaml url
- https://github.com/urllib3/urllib3/blob/main/CHANGES.rst#1264-2021-03-15 url
- https://pypi.org/project/urllib3/1.26.4 url
- https://github.com/urllib3/urllib3 package
- https://github.com/urllib3/urllib3/releases/tag/1.26.4 url
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4S65ZQVZ2ODGB52IC7VJDBUK4M5INCXL url