Описание
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts ([]), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.
A flaw was found in Python. The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts ([]), allowing hosts that weren't IPv6 or IPvFuture compliant. This behavior was not conformant to RFC 3986 and was potentially vulnerable to server-side request forgery (SSRF) if a URL is processed by more than one URL parser.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 10 | python3.12 | Not affected | ||
| Red Hat Enterprise Linux 8 | python3.11 | Not affected | ||
| Red Hat Enterprise Linux 8 | python3.12 | Not affected | ||
| Red Hat Enterprise Linux 9 | python3.11 | Not affected | ||
| Red Hat Enterprise Linux 9 | python3.12 | Not affected | ||
| Red Hat Enterprise Linux 8 | python3 | Fixed | RHSA-2024:10779 | 04.12.2024 |
| Red Hat Enterprise Linux 8 | python39 | Fixed | RHSA-2025:23530 | 18.12.2025 |
| Red Hat Enterprise Linux 8 | python39-devel | Fixed | RHSA-2025:23530 | 18.12.2025 |
| Red Hat Enterprise Linux 8 | python3 | Fixed | RHSA-2024:10779 | 04.12.2024 |
| Red Hat Enterprise Linux 9 | python3.9 | Fixed | RHSA-2024:10983 | 12.12.2024 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
EPSS
3.7 Low
CVSS3
Связанные уязвимости
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.
The urllib.parse.urlsplit() and urlparse() functions improperly valida ...
EPSS
3.7 Low
CVSS3