Search/CVE-2019-11324
● CVE — High

CVE-2019-11324

Vendorcanonical, pythonProductubuntu linux, urllib3DiscoveredApr 18, 2019UpdatedNov 21, 2024

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

View graph Watch Export
CVSS v3.1
7.5 HIGH
EPSS
2.92%
probability of exploitation in 30 days
CISA KEV
Not listed
no confirmed exploitation reported
News coverage
0
sources referencing this CVE
Related IOCs
0
seen in the same coverage
EPSS Trend
Aug 16, 2026 → Oct 22, 2026
▲ 0.08pp
2.84% → 2.92% over 10 tracked changes
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityLOW
Privileges RequiredNONE
User InteractionNONE
ScopeUNCHANGED
ConfidentialityNONE
IntegrityHIGH
AvailabilityNONE
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Connections
3 relationships
Timeline
disclosure → media coverage
Apr 18, 2019
Disclosure — published as a CVE record. · last revised by NVD Nov 21, 2024