CVE-2016-9015: Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly vali...

Description

Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.

Metrics

EPSS Probability

0.78%

51.0th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

CWE-295

Affected Software

Vendor	Product	Versions
Python	Urllib3	1.17
Python	Urllib3	1.18

References

http://www.openwall.com/lists/oss-security/2016/10/27/6Mailing List, Mitigation
http://www.securityfocus.com/bid/93941Third Party Advisory, VDB Entry
http://www.openwall.com/lists/oss-security/2016/10/27/6Mailing List, Mitigation
http://www.securityfocus.com/bid/93941Third Party Advisory, VDB Entry

Timeline

Published: Jan 11, 2017
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2016-9015?

Versions 1.17 and 1.18 of the Python urllib3 library suffer from a vulnerability that can cause them, in certain configurations, to not correctly validate TLS certificates. This places users of the library with those configurations at risk of man-in-the-middle and information leakage attacks. This vulnerability affects users using versions 1.17 and 1.18 of the urllib3 library, who are using the optional PyOpenSSL support for TLS instead of the regular standard library TLS backend, and who are using OpenSSL 1.1.0 via PyOpenSSL. This is an extremely uncommon configuration, so the security impact of this vulnerability is low.

How severe is CVE-2016-9015?

Severity scoring for CVE-2016-9015 is pending analysis. The EPSS model estimates a 0.78% probability of exploitation in the next 30 days.

How do I fix CVE-2016-9015?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2016

View all 2016CVEs →