Description
Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 12 SP4 | python-setuptools | 40.6.2-4.12.23 | SUSE-RU-2019:2627-1 |
| SLES 12 | python-PyJWT | 1.4.2-3.10.27 | SUSE-RU-2019:2627-1 |
| SLES 12 | python-cliff | 1.14.0-11.3.2 | SUSE-RU-2019:2627-1 |
| SLES 12 | python-mock | 2.0.0-3.7.25 | SUSE-RU-2019:2627-1 |
| SLES 12 | python-oauthlib | 0.7.2-3.9.20 | SUSE-RU-2019:2627-1 |
| SLES 12 | python-pbr | 3.1.1-3.5.2 | SUSE-RU-2019:2627-1 |
| SLES 12 | python-rsa | 3.1.4-12.9.17 | SUSE-RU-2019:2627-1 |
| SLES 12 | python-setuptools | 40.6.2-4.12.23 | SUSE-RU-2019:2627-1 |
| SLES 12 | python-stevedore | 1.8.0-16.2.1 | SUSE-RU-2019:2627-1 |
| SLES 12 | python-urllib3 | 1.22-3.10.1 | SUSE-SU-2019:0139-1 |
Show 9 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 12 SP4 | python-setuptools | 40.6.2-4.12.23 | SUSE-RU-2019:2627-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-oauthlib | 0.7.2-3.9.20 | SUSE-RU-2019:2627-1 |
| SUSE OpenStack Cloud 8 | python-oauthlib | 0.7.2-3.9.20 | SUSE-RU-2019:2627-1 |
| SUSE OpenStack Cloud 7 | python-PyJWT | 1.4.2-3.10.27 | SUSE-RU-2019:2627-1 |
| SUSE OpenStack Cloud 7 | python-oauthlib | 0.7.2-3.9.20 | SUSE-RU-2019:2627-1 |
| SUSE OpenStack Cloud 7 | python-rsa | 3.1.4-12.9.17 | SUSE-RU-2019:2627-1 |
| SUSE OpenStack Cloud 7 | python-setuptools | 40.6.2-4.12.23 | SUSE-RU-2019:2627-1 |
| SUSE Manager Server 3.2 | python-PyJWT | 1.4.2-3.10.27 | SUSE-RU-2019:2627-1 |
| SUSE Manager Server 3.2 | python-oauthlib | 0.7.2-3.9.20 | SUSE-RU-2019:2627-1 |
| SUSE Manager Server 3.2 | python-rsa | 3.1.4-12.9.17 | SUSE-RU-2019:2627-1 |
| SUSE Manager Server 3.2 | python-urllib3 | 1.22-3.10.1 | SUSE-SU-2019:0139-1 |
| SUSE Manager Server 3.1 | python-urllib3 | 1.22-3.10.1 | SUSE-SU-2019:0139-1 |
| SUSE HPE Helion OpenStack 8 | python-oauthlib | 0.7.2-3.9.20 | SUSE-RU-2019:2627-1 |
| SUSE Enterprise Storage 5 | python-rsa | 3.1.4-12.9.17 | SUSE-RU-2019:2627-1 |
| SUSE Enterprise Storage 5 | python-urllib3 | 1.22-3.10.1 | SUSE-SU-2019:0139-1 |
| SUSE Enterprise Storage 4 | python-rsa | 3.1.4-12.9.17 | SUSE-RU-2019:2627-1 |
| SUSE Enterprise Storage 4 | python-urllib3 | 1.22-3.10.1 | SUSE-SU-2019:0139-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-urllib3 | 1.26.6-1.2 | openSUSE-SU-2026:12044-1, openSUSE-SU-2024:14055-1, openSUSE-SU-2024:11277-1 |
| openSUSE Tumbleweed | python-urllib3_1 | 1.26.20-7.2 | openSUSE-SU-2026:12045-1 |
| openSUSE Tumbleweed | python3-urllib3 | 1.18.1-1.2 | openSUSE-SU-2024:10540-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | urllib3 | >= 1.17, < 1.18.1 | 1.18.1 | GHSA-v4w5-p2hg-8fh6 |
Advisories 7
- openSUSE-SU-2026:12044-1 python313-urllib3-2.8.0-1.1 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- openSUSE-SU-2026:12045-1 python313-urllib3_1-1.26.20-7.2 on GA media SUSE / openSUSE Security Updates · Oct 5, 2026
- openSUSE-SU-2024:14055-1 python310-urllib3-2.1.0-3.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:11277-1 python36-urllib3-1.26.6-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-RU-2019:2627-1 Recommended update for python-setuptools and dependend packages SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2019:0139-1 Security update for python-urllib3 SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:10540-1 python3-urllib3-1.18.1-1.2 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026