Bug 2543255 (CVE-2026-97687)
| Summary: | CVE-2026-97687 urllib3: urllib3: Traffic interception via HTTPS proxy TLS configuration override | ||
|---|---|---|---|
| Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
| Component: | vulnerability | Assignee: | Product Security <prodsec-ir-bot> |
| Status: | NEW --- | QA Contact: | |
| Severity: | high | Docs Contact: | |
| Priority: | high | ||
| Version: | unspecified | CC: | abarbaro, adinn, akhatavk, alinfoot, alizardo, anpicker, anthomas, aos-team-art-private, aprice, asdas, asegurap, bbrownin, blitton, brasmith, cahl, cmyers, cochase, crizzo, dfreiber, dkeler, dnakabaa, doconnor, dpaolell, dranck, drow, dschmidt, dtrifiro, dymurray, eborisov, ebourniv, eglynn, ehelms, fzakkak, galder, gbenhaim, ggainey, gparvin, gtanzill, hasun, hoberger, ibolton, ilpinto, jbalunas, jburrell, jbuscemi, jchui, jdelft, jdobes, jfula, jhe, jholecek, jjoyce, jlanda, jmatthew, jmitchel, jmontleo, jowilson, jpasqual, jpretori, jsamir, jschluet, jupierce, juwatts, jwong, kaycoth, kbempah, kgaikwad, kshier, ktsao, lball, lbrazdil, lcouzens, lgarciaa, lhh, ljawale, lpele, ltomasbo, mbabacek, mbarnett, mbiarnes, mburns, mdellweg, mgarciac, mhayden, mhulan, mminar, mrunge, msilmser, mwoodson, nboldt, ngough, niyer, nmoumoul, nyancey, oaljalju, oezr, olubyans, omaciel, ometelka, orabin, osousa, pakotvan, pcreech, pgaikwad, pjindal, ppalepu, ppostler, prdhamdh, prwatson, psrna, ptisnovs, rbiba, rbobbitt, rchan, rekumar, rhaigner, rhel-process-autobot, rjohnson, sarad, sbiarozk, sbunciak, sdoran, sgehwolf, sghai, sidsharm, simaishi, slucidi, smallamp, solenoci, sprizend, sseago, sskracic, stcannon, sthirugn, suppawar, syedriko, thason, tmalecek, tpfromme, tqvarnst, tsze, twaugh, veshanka, vimartin, vkumar, vlaad, vvoronko, watson-tool-maintainers, weaton, xdharmai, yguenane, ykashtan, zzhou |
| Target Milestone: | --- | Keywords: | Security |
| Target Release: | --- | ||
| Hardware: | All | ||
| OS: | Linux | ||
| Whiteboard: | |||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: |
A flaw was found in urllib3. This vulnerability allows a remote attacker on the network to intercept and alter data transmitted through an HTTPS proxy. The issue occurs when target-server Transport Layer Security (TLS) settings inadvertently overwrite the proxy's TLS configuration, which can disable certificate verification on reused connection contexts. Consequently, an attacker can impersonate the proxy to monitor or modify forwarded traffic or capture client credentials.
|
Story Points: | --- |
| Clone Of: | Environment: | ||
| Last Closed: | Type: | --- | |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
|
Description
OSIDB Bzimport
2026-09-29 15:54:30 UTC
This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:84578 https://access.redhat.com/errata/RHSA-2026:84578 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:84577 https://access.redhat.com/errata/RHSA-2026:84577 This issue has been addressed in the following products: Red Hat Enterprise Linux 10 Via RHSA-2026:85930 https://access.redhat.com/errata/RHSA-2026:85930 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:85929 https://access.redhat.com/errata/RHSA-2026:85929 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2026:90494 https://access.redhat.com/errata/RHSA-2026:90494 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2026:92474 https://access.redhat.com/errata/RHSA-2026:92474 This issue has been addressed in the following products: Red Hat Satellite 6.17 for RHEL 9 Via RHSA-2026:95656 https://access.redhat.com/errata/RHSA-2026:95656 This issue has been addressed in the following products: Red Hat Satellite 6.18 for RHEL 9 Via RHSA-2026:95657 https://access.redhat.com/errata/RHSA-2026:95657 This issue has been addressed in the following products: Red Hat Satellite 6.16 for RHEL 8 Red Hat Satellite 6.16 for RHEL 9 Via RHSA-2026:95655 https://access.redhat.com/errata/RHSA-2026:95655 This issue has been addressed in the following products: Red Hat Enterprise Linux 10.0 Extended Update Support Via RHSA-2026:98096 https://access.redhat.com/errata/RHSA-2026:98096 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:98097 https://access.redhat.com/errata/RHSA-2026:98097 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:98098 https://access.redhat.com/errata/RHSA-2026:98098 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions Via RHSA-2026:98125 https://access.redhat.com/errata/RHSA-2026:98125 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions Via RHSA-2026:98126 https://access.redhat.com/errata/RHSA-2026:98126 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.6 Extended Update Support Via RHSA-2026:98122 https://access.redhat.com/errata/RHSA-2026:98122 |