Описание
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
Пакеты
| Пакет | Статус | Версия исправления | Релиз | Тип |
|---|---|---|---|---|
| python3.14 | fixed | 3.14.3-1 | package | |
| python3.13 | fixed | 3.13.12-1 | package | |
| python3.13 | fixed | 3.13.5-2+deb13u1 | trixie | package |
| python3.11 | removed | package | ||
| python3.11 | fixed | 3.11.2-6+deb12u7 | bookworm | package |
| python3.9 | removed | package | ||
| pypy3 | fixed | 7.3.21+dfsg-1 | package | |
| pypy3 | no-dsa | trixie | package | |
| pypy3 | no-dsa | bookworm | package | |
| pypy3 | postponed | bullseye | package | |
| python2.7 | not-affected | package |
Примечания
https://github.com/python/cpython/issues/143925
https://github.com/python/cpython/pull/143926
https://mail.python.org/archives/list/security-announce@python.org/thread/X66HL7SISGJT33J53OHXMZT4DFLMHVKF/
https://github.com/python/cpython/commit/f25509e78e8be6ea73c811ac2b8c928c28841b9f (main)
https://github.com/python/cpython/commit/05356b1cc153108aaf27f3b72ce438af4aa218c0 (3.14 branch)
https://github.com/python/cpython/commit/a35ca3be5842505dab74dc0b90b89cde0405017a (3.13 branch)
https://github.com/python/cpython/commit/3f396ca9d7bbe2a50ea6b8c9b27c0082884d9f80 (3.11 branch)
https://github.com/python/cpython/commit/34d76b00dabde81a793bd06dd8ecb057838c4b38 (3.10-branch)
EPSS
Связанные уязвимости
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
User-controlled data URLs parsed by urllib.request.DataHandler allow injecting headers through newlines in the data URL mediatype.
Уязвимость компонента urllib.request.DataHandler интерпретатора языка программирования Python, позволяющая нарушителю оказать воздействие на целостность защищаемой информации
EPSS