CVE-2024-11168 | THREATINT

We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

Description

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

Reserved 2024-11-12 | Published 2024-11-12 | Updated 2025-04-11 | Assigner PSF

MEDIUM: 6.3CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:N

Product status

Default status

unaffected

Any version before 3.9.21

affected

3.10.0 before 3.10.16

affected

3.11.0 before 3.11.4

affected

3.12.0a1 before 3.12.0b1

affected

Credits

zer0yu (IPASSLab && ZGC Lab) reporter

References

github.com/...ommit/29f348e232e82938ba2165843c448c2b291504c5 patch

github.com/python/cpython/pull/103849 patch

github.com/python/cpython/issues/103848 issue-tracking

mail.python.org/.../thread/XPWB6XVZ5G5KGEI63M4AWLIEUF5BPH4T/ vendor-advisory

github.com/...ommit/b2171a2fd41416cf68afd67460578631d755a550 patch

github.com/...ommit/634ded45545ce8cbd6fd5d49785613dd7fa9b89e patch

github.com/...ommit/ddca2953191c67a12b1f19d6bca41016c6ae7132 patch

cve.org (CVE-2024-11168)

nvd.nist.gov (CVE-2024-11168)

Download JSON

https://cve.threatint.eu/CVE/CVE-2024-11168

Support options

Helpdesk Chat, Email, Knowledgebase