CVE-2019-11324

Name	CVE-2019-11324
Description	The urllib3 library before 1.24.2 for Python mishandles certain cases where the desired set of CA certificates is different from the OS store of CA certificates, which results in SSL connections succeeding in situations where a verification failure is the correct outcome. This is related to use of the ssl_context, ca_certs, or ca_certs_dir argument.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-2686-1, DLA-3610-1
Debian Bugs	927412

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
python-urllib3 (PTS)	bullseye	1.26.5-1~exp1	fixed
	bullseye (security)	1.26.5-1~exp1+deb11u1	fixed
	bookworm	1.26.12-1	fixed
	sid, trixie	2.2.3-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
python-urllib3	source	jessie	(not affected)
python-urllib3	source	stretch	1.19.1-1+deb9u1	DLA-2686-1
python-urllib3	source	buster	1.24.1-1+deb10u1	DLA-3610-1
python-urllib3	source	(unstable)	1.25.6-4		927412

Notes

[jessie] - python-urllib3 <not-affected> (Vulnerable code introduced later)
https://github.com/urllib3/urllib3/commit/1efadf43dc63317cd9eaa3e0fdb9e05ab07254b1
https://www.openwall.com/lists/oss-security/2019/04/17/3