CVE-2019-11324

The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.

• CWE-295

• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html
• http://www.openwall.com/lists/oss-security/2019/04/19/1Mailing List, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3335
• https://access.redhat.com/errata/RHSA-2019:3590
• https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/
• https://usn.ubuntu.com/3990-1/Third Party Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00039.html
• http://lists.opensuse.org/opensuse-security-announce/2019-09/msg00041.html
• http://www.openwall.com/lists/oss-security/2019/04/19/1Mailing List, Third Party Advisory
• https://access.redhat.com/errata/RHSA-2019:3335
• https://access.redhat.com/errata/RHSA-2019:3590
• https://github.com/urllib3/urllib3/compare/a6ec68a...1efadf4Patch, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2021/06/msg00015.html
• https://lists.debian.org/debian-lts-announce/2023/10/msg00012.html
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NKGPJLVLVYCL4L4B4G5TIOTVK4BKPG72/
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XOSA2NT4DUQDBEIWE6O7KKD24XND7TE2/
• https://usn.ubuntu.com/3990-1/Third Party Advisory

Published

Apr 18, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-11319An issue was discovered in Motorola CX2 1.01 and M2 1.01. Th…
• CVE-2019-1132An elevation of privilege vulnerability exists in Windows wh…7.8
• CVE-2019-11320In Motorola CX2 1.01 and M2 1.01, users can access the route…
• CVE-2019-11321An issue was discovered in Motorola CX2 1.01 and M2 1.01. Th…
• CVE-2019-11322An issue was discovered in Motorola CX2 1.01 and M2 1.01. Th…
• CVE-2019-11323HAProxy before 1.9.7 mishandles a reload with rotated keys, …5.9
• CVE-2019-11325An issue was discovered in Symfony before 4.2.12 and 4.3.x b…9.8
• CVE-2019-11326An issue was discovered on Topcon Positioning Net-G5 GNSS Re…8.8
• CVE-2019-11327An issue was discovered on Topcon Positioning Net-G5 GNSS Re…4.9
• CVE-2019-11328An issue was discovered in Singularity 3.1.0 to 3.2.0-rc2, a…8.8
• CVE-2019-1133A remote code execution vulnerability exists in the way that…7.5
• CVE-2019-11331Network Time Protocol (NTP), as specified in RFC 5905, uses …