Описание
The webbrowser.open() API would accept leading dashes in the URL which
could be handled as command line options for certain web browsers. New
behavior rejects leading dashes. Users are recommended to sanitize URLs
prior to passing to webbrowser.open().
A flaw was found in Python. The webbrowser.open() API, used to launch web browsers, does not properly sanitize input. This allows a remote attacker to craft a malicious URL containing leading dashes. When such a URL is opened, certain web browsers may interpret these dashes as command-line options, which could lead to unexpected behavior, information disclosure, or potentially arbitrary code execution, impacting the integrity of the system.
Меры по смягчению последствий
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise Linux 8 | python36:3.6/python36 | Not affected | ||
| Red Hat Enterprise Linux 8 | python39-devel:3.9/python39 | Not affected | ||
| Red Hat Enterprise Linux 10 | python3.12 | Fixed | RHSA-2026:6256 | 31.03.2026 |
| Red Hat Enterprise Linux 10 | python3.14 | Fixed | RHSA-2026:19019 | 19.05.2026 |
| Red Hat Enterprise Linux 10 | python3.12 | Fixed | RHSA-2026:19064 | 19.05.2026 |
| Red Hat Enterprise Linux 10.0 Extended Update Support | python3.12 | Fixed | RHSA-2026:7244 | 09.04.2026 |
| Red Hat Enterprise Linux 6 Extended Lifecycle Support - EXTENSION | python | Fixed | RHSA-2026:10102 | 23.04.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | python | Fixed | RHSA-2026:9614 | 22.04.2026 |
| Red Hat Enterprise Linux 7 Extended Lifecycle Support | python3 | Fixed | RHSA-2026:9745 | 22.04.2026 |
| Red Hat Enterprise Linux 8 | python3.11 | Fixed | RHSA-2026:6281 | 31.03.2026 |
Показывать по
Ссылки на источники
Дополнительная информация
Статус:
7.1 High
CVSS3
Связанные уязвимости
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
The webbrowser.open() API would accept leading dashes in the URL which could be handled as command line options for certain web browsers. New behavior rejects leading dashes. Users are recommended to sanitize URLs prior to passing to webbrowser.open().
The webbrowser.open() API would accept leading dashes in the URL which ...
7.1 High
CVSS3