Skip to content
Fencer Vulns
medium 6.5

CVE-2021-28363 json

Using default SSLContext for HTTPS requests in an HTTPS proxy doesn't verify certificate hostname for proxy connection

published 2021-03-15 5 y ago modified 2026-10-14 26 d ago also GHSA-5phf-pp7p-vc2r , PYSEC-2021-59 , EUVD-2021-0457

cvss
6.5
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
2.2%
EPSS 2.2% chance of exploitation in 30 days, percentile 82%
public exploits
0
none known

Summary

The urllib3 library 1.26.x before 1.26.4 for Python omits SSL certificate validation in some cases involving HTTPS to HTTPS proxies. The initial connection to the HTTPS proxy (if an SSLContext isn't given via proxy_config) doesn't verify the hostname of the certificate. This means certificates for different servers that still validate properly with the default urllib3 SSLContext will be silently accepted.

Patch / fix

  • pypi urllib3 1.26.4
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • python-urllib3 Debian 14, Debian 13, Debian 12 1.26.4-1

debian advisories DEBIAN-CVE-2021-28363

  • python-urllib3 openshift 3.11 1:1.24.3-2.el7
  • python2-urllib3 openshift 3.11 1:1.24.3-2.el7

red hat advisories RHBA-2021:1147

  • py3-urllib3 Alpine 3.24, Alpine 3.23, Alpine 3.22 +8 more 1.26.4-r0

alpine advisories ALPINE-CVE-2021-28363

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python-urllib3 Arch Linux 1.26.4-1

arch linux advisories AVG-1691

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-28363 updated cvss 6.5

python-urllib3: HTTPS proxy host name not validated when using default SSLContext

  • Red Hat OpenShift Container Platform 4 python-urllib3, python2-urllib3
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 3.11 python-urllib3 1.24.3-2.el7, python2-urllib3 1.24.3-2.el7
    fixed: vendor fix RHBA-2021:1147
  • Red Hat Enterprise Linux 6 python-urllib3 Red Hat Enterprise Linux 7 python-pip, python3-pip, python-urllib3 Red Hat Enterprise Linux 8 python-pip, python2-pip, python3-pip, python38-pip, python39-pip, python3x-pip, +7 more Red Hat Enterprise Linux 9 python-urllib3, python3-urllib3 Red Hat OpenShift Container Platform 3.11 python-pexpect 4.6-1.el7at, python-daemon 2.1.2-7.el7at, python-psutil 5.4.3-3.el7ar, python2-pexpect 4.6-1.el7at, ansible-runner 1.2.0-1.el7ar, python2-daemon 2.1.2-7.el7at, +45 more Red Hat OpenStack Platform 10 (Newton) python-urllib3
    +4 more products
    Red Hat OpenStack Platform 13 (Queens) python2-urllib3 Red Hat Quay 3 quay/quay-rhel8 Red Hat Software Collections python27-python-pip, rh-python36-python-pip, rh-python38-python-pip, rh-python38-python-urllib3, rh-mongodb36-python-urllib3, rh-python38-python-pip-wheel Red Hat Storage 3 python-urllib3, python2-urllib3
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 6.5

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Exploit prediction

2.17% chance of exploitation in the next 30 days, higher than 82% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
NVD 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected packages

ecosystem package affected fixed in
pypi urllib3
>=1.26.0, <1.26.4
1.26.4

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-295 Improper Certificate Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.