CVE-2016-9015
Fixed in a distro release EPSS <1%
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
Products: python urllib3
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | urllib3 | 1.18.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| SUSE Enterprise Storage 4 | python-rsa | 3.1.4-12.9.17 |
| SUSE Enterprise Storage 4 | python-urllib3 | 1.22-3.10.1 |
| SUSE Enterprise Storage 5 | python-rsa | 3.1.4-12.9.17 |
| SUSE Enterprise Storage 5 | python-urllib3 | 1.22-3.10.1 |
| SUSE HPE Helion OpenStack 8 | python-oauthlib | 0.7.2-3.9.20 |
| SUSE Linux Enterprise Desktop 12 SP4 | python-setuptools | 40.6.2-4.12.23 |
| SUSE Linux Enterprise Module for Containers 12 | python-setuptools | 40.6.2-4.12.23 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-PyJWT | 1.4.2-3.10.27 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-cliff | 1.14.0-11.3.2 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-mock | 2.0.0-3.7.25 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-oauthlib | 0.7.2-3.9.20 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-pbr | 3.1.1-3.5.2 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-rsa | 3.1.4-12.9.17 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-setuptools | 40.6.2-4.12.23 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-stevedore | 1.8.0-16.2.1 |
| SUSE Linux Enterprise Module for Public Cloud 12 | python-urllib3 | 1.22-3.10.1 |
| SUSE Linux Enterprise Server 12 SP4 | python-setuptools | 40.6.2-4.12.23 |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | python-setuptools | 40.6.2-4.12.23 |
| SUSE Linux Enterprise Software Development Kit 12 SP4 | python-setuptools | 40.6.2-4.12.23 |
| SUSE Manager Server 3.1 | python-urllib3 | 1.22-3.10.1 |
| SUSE Manager Server 3.2 | python-PyJWT | 1.4.2-3.10.27 |
| SUSE Manager Server 3.2 | python-oauthlib | 0.7.2-3.9.20 |
| SUSE Manager Server 3.2 | python-rsa | 3.1.4-12.9.17 |
| SUSE Manager Server 3.2 | python-urllib3 | 1.22-3.10.1 |
| SUSE OpenStack Cloud 7 | python-PyJWT | 1.4.2-3.10.27 |
| SUSE OpenStack Cloud 7 | python-oauthlib | 0.7.2-3.9.20 |
| SUSE OpenStack Cloud 7 | python-rsa | 3.1.4-12.9.17 |
| SUSE OpenStack Cloud 7 | python-setuptools | 40.6.2-4.12.23 |
| SUSE OpenStack Cloud 8 | python-oauthlib | 0.7.2-3.9.20 |
| SUSE OpenStack Cloud Crowbar 8 | python-oauthlib | 0.7.2-3.9.20 |
| openSUSE Tumbleweed | python-urllib3 | 2.8.0-1.1 |
| openSUSE Tumbleweed | python-urllib3 | 2.1.0-3.1 |
| openSUSE Tumbleweed | python-urllib3 | 1.26.6-1.2 |
| openSUSE Tumbleweed | python-urllib3_1 | 1.26.20-7.2 |
| openSUSE Tumbleweed | python3-urllib3 | 1.18.1-1.2 |