urllib3.... affected by certificate verification bypass. High risk!" in my arch-audit stdout...?

user_15439180 0
Viewed 128

Hello I have an message into the return of my arch-audit: "python-urllib3 is affected by certificate verification bypass. High risk!"

What is the signification ? It's the code of 'python-urllib3' have an security breach ? Or else ? Because if I understand really good... it's an part of the code or this lib have incapacity of good check the certifications of asymmetric encrypted communication ? So I think about reverse-shell and a lot of attacks possibles, it's dangerous, I think not tell bullshit if I tell: anybody can exploit this for usurpation of the certificate and take the control of an SSL/TLS transmission ? All right ? ...

I don't know, Sorry for my bad and poor english, and if my question is stupid at other look side.

I try to learn, I eat Arch Wiki.

  • Rick.
arch urllib3 python-3.8 python
1 Answers

urllib3 does verify TLS certificates by default, but this is a bug for a specific version and setting of urllib3 (which affected the version available in arch). If you check arch's bugtracker, you'll find the CVE in question.

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

You can either upgrade to 1.26.4 or conclude that this situation doesn't affect how you (or your applications) are using urllib3. If you're not using a HTTPS proxy it seems like this won't affect you, but read the CVE and make a decision for your own use case.

There is nothing here that leads me to believe that this would lead to a compromise of any sort, unless you're doing weird things (like authenticating remote code to run locally based on the SSL certificate for a specific host).

user_1376500
Related