Description
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.
Product status
Any version before 3.9.21
3.10.0 before 3.10.16
3.11.0 before 3.11.4
3.12.0a1 before 3.12.0b1
Credits
zer0yu (IPASSLab && ZGC Lab)
References
github.com/...ommit/29f348e232e82938ba2165843c448c2b291504c5
github.com/python/cpython/pull/103849
github.com/python/cpython/issues/103848
mail.python.org/.../thread/XPWB6XVZ5G5KGEI63M4AWLIEUF5BPH4T/
github.com/...ommit/b2171a2fd41416cf68afd67460578631d755a550
github.com/...ommit/634ded45545ce8cbd6fd5d49785613dd7fa9b89e
github.com/...ommit/ddca2953191c67a12b1f19d6bca41016c6ae7132