CVE-2016-9015

Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.

CVSS v3 3.7 LOW
CVSS v2.0 2.6 LOW

3.7^/10

CVSS v3 : LOW

Vector : AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability : 2.2 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.openwall.com/lists/oss-security/2016/10/27/6	Mailing List Mitigation
http://www.securityfocus.com/bid/93941	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:python:urllib3:1.17:::::::*
	cpe:2.3:a:python:urllib3:1.18:::::::*

History

No history.

Information

Published : 2017-01-11 16:59

Updated : 2023-12-10 12:01

NVD link : CVE-2016-9015

Mitre link : CVE-2016-9015

CVE.ORG link : CVE-2016-9015

JSON object : View

Products Affected

python

urllib3

CWE

CWE-295

Improper Certificate Validation

{"id": "CVE-2016-9015", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.7, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 2.2}]}, "published": "2017-01-11T16:59:00.347", "references": [{"url": "http://www.openwall.com/lists/oss-security/2016/10/27/6", "tags": ["Mailing List", "Mitigation"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/93941", "tags": ["Third Party Advisory", "VDB Entry"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-295"}]}], "descriptions": [{"lang": "en", "value": "Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low."}, {"lang": "es", "value": "Versiones 1.17 y 1.18 de la librer\u00eda de Python urllib3 sufren una vulnerabilidad que puede provocarles, en ciertas configuraciones, que no validen correctamente certificados TLS. Esto coloca a usuarios de la librer\u00eda con aquellas configuraciones en peligro de ataques man-in-the-middle y de filtraci\u00f3n de informaci\u00f3n. Esta vulnerabilidad afecta a usuarios que utilizan versiones 1.17 y 1.18 de la librer\u00eda urllib3, que est\u00e1n utilizando el soporte PyOpenSSL opcional para TLS en lugar del backend TLS regular de una librer\u00eda est\u00e1ndar, y que est\u00e1n usando OpenSSL 1.1.0 a trav\u00e9s de PyOpenSSL. Esta es una configuraci\u00f3n extremadamente poco com\u00fan, por lo que el impacto de seguridad de esta vulnerabilidad es bajo."}], "lastModified": "2017-01-13T13:09:19.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:python:urllib3:1.17:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0D13162D-373A-4872-B2DC-F7088DB878ED"}, {"criteria": "cpe:2.3:a:python:urllib3:1.18:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "FF034AE6-0FE0-45DF-9DC6-E536337CF9D4"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}