{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2023-24329", "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "assignerShortName": "mitre", "dateUpdated": "2024-08-02T10:56:03.505Z", "dateReserved": "2023-01-23T00:00:00", "datePublished": "2023-02-17T00:00:00"}, "containers": {"cna": {"providerMetadata": {"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca", "shortName": "mitre", "dateUpdated": "2023-09-20T21:06:19.477131"}, "descriptions": [{"lang": "en", "value": "An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}], "affected": [{"vendor": "n/a", "product": "n/a", "versions": [{"version": "n/a", "status": "affected"}]}], "references": [{"url": "https://pointernull.com/security/python-url-parse-problem.html"}, {"url": "https://github.com/python/cpython/pull/99421"}, {"url": "https://security.netapp.com/advisory/ntap-20230324-0004/"}, {"name": "FEDORA-2023-b3a3df39dd", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/"}, {"name": "FEDORA-2023-406c1c6ed7", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/"}, {"name": "FEDORA-2023-1092538441", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/"}, {"name": "FEDORA-2023-63c69aa712", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/"}, {"name": "FEDORA-2023-96aa33f0d3", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/"}, {"name": "FEDORA-2023-953c2607d8", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/"}, {"name": "FEDORA-2023-2b25dd2a11", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/"}, {"name": "FEDORA-2023-994ecd7dbc", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/"}, {"name": "FEDORA-2023-690e150a39", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/"}, {"name": "FEDORA-2023-81bb8e3b99", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/"}, {"name": "FEDORA-2023-d8b0003ecd", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/"}, {"name": "FEDORA-2023-56cefa23df", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/"}, {"url": "https://github.com/python/cpython/issues/102153"}, {"name": "FEDORA-2023-31888c4781", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/"}, {"name": "FEDORA-2023-acdfd145f2", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/"}, {"name": "FEDORA-2023-03599274db", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/"}, {"name": "FEDORA-2023-b854908745", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/"}, {"name": "FEDORA-2023-d294ef140e", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/"}, {"name": "FEDORA-2023-309cadedc6", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/"}, {"name": "FEDORA-2023-401947eb94", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/"}, {"name": "FEDORA-2023-f52390b9d2", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/"}, {"name": "FEDORA-2023-dd526ed2e4", "tags": ["vendor-advisory"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/"}, {"name": "VU#127587", "tags": ["third-party-advisory"], "url": "https://www.kb.cert.org/vuls/id/127587"}, {"name": "[debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update", "tags": ["mailing-list"], "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"}], "problemTypes": [{"descriptions": [{"type": "text", "lang": "en", "description": "n/a"}]}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T10:56:03.505Z"}, "title": "CVE Program Container", "references": [{"url": "https://pointernull.com/security/python-url-parse-problem.html", "tags": ["x_transferred"]}, {"url": "https://github.com/python/cpython/pull/99421", "tags": ["x_transferred"]}, {"url": "https://security.netapp.com/advisory/ntap-20230324-0004/", "tags": ["x_transferred"]}, {"name": "FEDORA-2023-b3a3df39dd", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/"}, {"name": "FEDORA-2023-406c1c6ed7", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/"}, {"name": "FEDORA-2023-1092538441", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/"}, {"name": "FEDORA-2023-63c69aa712", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/"}, {"name": "FEDORA-2023-96aa33f0d3", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/"}, {"name": "FEDORA-2023-953c2607d8", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/"}, {"name": "FEDORA-2023-2b25dd2a11", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/"}, {"name": "FEDORA-2023-994ecd7dbc", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/"}, {"name": "FEDORA-2023-690e150a39", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/"}, {"name": "FEDORA-2023-81bb8e3b99", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/"}, {"name": "FEDORA-2023-d8b0003ecd", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/"}, {"name": "FEDORA-2023-56cefa23df", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/"}, {"url": "https://github.com/python/cpython/issues/102153", "tags": ["x_transferred"]}, {"name": "FEDORA-2023-31888c4781", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/"}, {"name": "FEDORA-2023-acdfd145f2", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/"}, {"name": "FEDORA-2023-03599274db", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/"}, {"name": "FEDORA-2023-b854908745", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/"}, {"name": "FEDORA-2023-d294ef140e", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/"}, {"name": "FEDORA-2023-309cadedc6", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/"}, {"name": "FEDORA-2023-401947eb94", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/"}, {"name": "FEDORA-2023-f52390b9d2", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/"}, {"name": "FEDORA-2023-dd526ed2e4", "tags": ["vendor-advisory", "x_transferred"], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/"}, {"name": "VU#127587", "tags": ["third-party-advisory", "x_transferred"], "url": "https://www.kb.cert.org/vuls/id/127587"}, {"name": "[debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update", "tags": ["mailing-list", "x_transferred"], "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"}]}]}}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "CC324629-0240-4DC0-BAFA-D476D5FDDA61", "versionEndExcluding": "3.7.17", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "0A6B1607-9E1F-4A14-918F-B1A1786D028E", "versionEndExcluding": "3.8.17", "versionStartIncluding": "3.8.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "0287FC5A-256F-40EE-93D0-2DFFE38BB5A1", "versionEndExcluding": "3.9.17", "versionStartIncluding": "3.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "4AA7FA11-C746-4E69-94C2-18E745D82054", "versionEndExcluding": "3.10.12", "versionStartIncluding": "3.10.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:python:python:*:*:*:*:*:*:*:*", "matchCriteriaId": "AD14A157-FEA9-411F-B338-F1B6F726599D", "versionEndExcluding": "3.11.4", "versionStartIncluding": "3.11.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*", "matchCriteriaId": "CC559B26-5DFC-4B7A-A27C-B77DE755DFF9", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*", "matchCriteriaId": "3A756737-1CC4-42C2-A4DF-E1C893B4E2D5", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*", "matchCriteriaId": "B55E8D50-99B4-47EC-86F9-699B67D473CE", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*", "matchCriteriaId": "86B51137-28D9-41F2-AFA2-3CC22B4954D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*", "matchCriteriaId": "4455CF3A-CC91-4BE4-A7AB-929AC82E34F5", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*", "matchCriteriaId": "E7CF3019-975D-40BB-A8A4-894E62BD3797", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters."}, {"lang": "es", "value": "Un problema en el componente urllib.parse de Python anterior a 3.11.4 permite a los atacantes eludir los m\u00e9todos de listas de bloqueo proporcionando una URL que comienza con caracteres en blanco."}], "id": "CVE-2023-24329", "lastModified": "2024-11-21T07:47:40.647", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-02-17T15:15:12.243", "references": [{"source": "[email protected]", "tags": ["Issue Tracking"], "url": "https://github.com/python/cpython/issues/102153"}, {"source": "[email protected]", "tags": ["Patch"], "url": "https://github.com/python/cpython/pull/99421"}, {"source": "[email protected]", "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/"}, {"source": "[email protected]", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/"}, {"source": "[email protected]", "tags": ["Exploit", "Mitigation", "Technical Description", "Third Party Advisory"], "url": "https://pointernull.com/security/python-url-parse-problem.html"}, {"source": "[email protected]", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20230324-0004/"}, {"source": "[email protected]", "url": "https://www.kb.cert.org/vuls/id/127587"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Issue Tracking"], "url": "https://github.com/python/cpython/issues/102153"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch"], "url": "https://github.com/python/cpython/pull/99421"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Mitigation", "Technical Description", "Third Party Advisory"], "url": "https://pointernull.com/security/python-url-parse-problem.html"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.netapp.com/advisory/ntap-20230324-0004/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://www.kb.cert.org/vuls/id/127587"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "[email protected]", "type": "Primary"}]}

{"affected_release": [{"advisory": "RHSA-2023:3550", "cpe": "cpe:/o:redhat:rhel_els:6", "package": "python-0:2.6.6-69.el6_10", "product_name": "Red Hat Enterprise Linux 6 Extended Lifecycle Support", "release_date": "2023-06-08T00:00:00Z"}, {"advisory": "RHSA-2023:3555", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "python-0:2.7.5-93.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2023-06-09T00:00:00Z"}, {"advisory": "RHSA-2023:3556", "cpe": "cpe:/o:redhat:enterprise_linux:7", "package": "python3-0:3.6.8-19.el7_9", "product_name": "Red Hat Enterprise Linux 7", "release_date": "2023-06-09T00:00:00Z"}, {"advisory": "RHSA-2023:3591", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "python3-0:3.6.8-51.el8_8.1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-06-14T00:00:00Z"}, {"advisory": "RHSA-2023:3594", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "python3.11-0:3.11.2-2.el8_8.1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-06-14T00:00:00Z"}, {"advisory": "RHSA-2023:3780", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "python27:2.7-8080020230609134836.392b0bf1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-06-22T00:00:00Z"}, {"advisory": "RHSA-2023:3781", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "python38:3.8-8080020230531142020.a822e92f", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-06-22T00:00:00Z"}, {"advisory": "RHSA-2023:3781", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "python38-devel:3.8-8080020230531142020.a822e92f", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-06-22T00:00:00Z"}, {"advisory": "RHSA-2023:3811", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "python39:3.9-8080020230531142208.93c2fc2f", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-06-27T00:00:00Z"}, {"advisory": "RHSA-2023:3811", "cpe": "cpe:/a:redhat:enterprise_linux:8", "package": "python39-devel:3.9-8080020230531142208.93c2fc2f", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-06-27T00:00:00Z"}, {"advisory": "RHSA-2023:3591", "cpe": "cpe:/o:redhat:enterprise_linux:8", "package": "python3-0:3.6.8-51.el8_8.1", "product_name": "Red Hat Enterprise Linux 8", "release_date": "2023-06-14T00:00:00Z"}, {"advisory": "RHSA-2023:3932", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "python27:2.7-8010020230614130243.208b345f", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:3936", "cpe": "cpe:/a:redhat:rhel_e4s:8.1", "package": "python3-0:3.6.8-15.1.el8_1.1", "product_name": "Red Hat Enterprise Linux 8.1 Update Services for SAP Solutions", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:3777", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "python27:2.7-8020020230614130117.c9f5743f", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2023-06-22T00:00:00Z"}, {"advisory": "RHSA-2023:3935", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "python3-0:3.6.8-24.el8_2.1", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:4038", "cpe": "cpe:/a:redhat:rhel_aus:8.2", "package": "python38:3.8-8020020230628091203.8c0020b9", "product_name": "Red Hat Enterprise Linux 8.2 Advanced Update Support", "release_date": "2023-07-12T00:00:00Z"}, {"advisory": "RHSA-2023:3777", "cpe": "cpe:/a:redhat:rhel_tus:8.2", "package": "python27:2.7-8020020230614130117.c9f5743f", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2023-06-22T00:00:00Z"}, {"advisory": "RHSA-2023:3935", "cpe": "cpe:/a:redhat:rhel_tus:8.2", "package": "python3-0:3.6.8-24.el8_2.1", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:4038", "cpe": "cpe:/a:redhat:rhel_tus:8.2", "package": "python38:3.8-8020020230628091203.8c0020b9", "product_name": "Red Hat Enterprise Linux 8.2 Telecommunications Update Service", "release_date": "2023-07-12T00:00:00Z"}, {"advisory": "RHSA-2023:3777", "cpe": "cpe:/a:redhat:rhel_e4s:8.2", "package": "python27:2.7-8020020230614130117.c9f5743f", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2023-06-22T00:00:00Z"}, {"advisory": "RHSA-2023:3935", "cpe": "cpe:/a:redhat:rhel_e4s:8.2", "package": "python3-0:3.6.8-24.el8_2.1", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:4038", "cpe": "cpe:/a:redhat:rhel_e4s:8.2", "package": "python38:3.8-8020020230628091203.8c0020b9", "product_name": "Red Hat Enterprise Linux 8.2 Update Services for SAP Solutions", "release_date": "2023-07-12T00:00:00Z"}, {"advisory": "RHSA-2023:3931", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "python27:2.7-8040020230613113051.7c6da464", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:3934", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "python3-0:3.6.8-39.el8_4.2", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:4004", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "python39:3.9-8040020230614130711.63cd9eba", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2023-07-10T00:00:00Z"}, {"advisory": "RHSA-2023:4008", "cpe": "cpe:/a:redhat:rhel_aus:8.4", "package": "python38:3.8-8040020230626111739.6dfe838a", "product_name": "Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support", "release_date": "2023-07-10T00:00:00Z"}, {"advisory": "RHSA-2023:3931", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "python27:2.7-8040020230613113051.7c6da464", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:3934", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "python3-0:3.6.8-39.el8_4.2", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:4004", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "python39:3.9-8040020230614130711.63cd9eba", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2023-07-10T00:00:00Z"}, {"advisory": "RHSA-2023:4008", "cpe": "cpe:/a:redhat:rhel_tus:8.4", "package": "python38:3.8-8040020230626111739.6dfe838a", "product_name": "Red Hat Enterprise Linux 8.4 Telecommunications Update Service", "release_date": "2023-07-10T00:00:00Z"}, {"advisory": "RHSA-2023:3931", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "python27:2.7-8040020230613113051.7c6da464", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:3934", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "python3-0:3.6.8-39.el8_4.2", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2023-06-29T00:00:00Z"}, {"advisory": "RHSA-2023:4004", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "python39:3.9-8040020230614130711.63cd9eba", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2023-07-10T00:00:00Z"}, {"advisory": "RHSA-2023:4008", "cpe": "cpe:/a:redhat:rhel_e4s:8.4", "package": "python38:3.8-8040020230626111739.6dfe838a", "product_name": "Red Hat Enterprise Linux 8.4 Update Services for SAP Solutions", "release_date": "2023-07-10T00:00:00Z"}, {"advisory": "RHSA-2023:3776", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "python39:3.9-8060020230614130816.6a631399", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-06-22T00:00:00Z"}, {"advisory": "RHSA-2023:3776", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "python39-devel:3.9-8060020230614130816.6a631399", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-06-22T00:00:00Z"}, {"advisory": "RHSA-2023:3796", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "python3-0:3.6.8-47.el8_6.1", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-06-26T00:00:00Z"}, {"advisory": "RHSA-2023:3810", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "python27:2.7-8060020230612150703.2aa69ce4", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-06-27T00:00:00Z"}, {"advisory": "RHSA-2023:4032", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "python38:3.8-8060020230627164849.e505919a", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-07-12T00:00:00Z"}, {"advisory": "RHSA-2023:4032", "cpe": "cpe:/a:redhat:rhel_eus:8.6", "package": "python38-devel:3.8-8060020230627164849.e505919a", "product_name": "Red Hat Enterprise Linux 8.6 Extended Update Support", "release_date": "2023-07-12T00:00:00Z"}, {"advisory": "RHSA-2023:3585", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "python3.11-0:3.11.2-2.el9_2.1", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-06-14T00:00:00Z"}, {"advisory": "RHSA-2023:3595", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "python3.9-0:3.9.16-1.el9_2.1", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-06-14T00:00:00Z"}, {"advisory": "RHSA-2023:3595", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "python3.9-0:3.9.16-1.el9_2.1", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2023-06-14T00:00:00Z"}, {"advisory": "RHSA-2023:4203", "cpe": "cpe:/a:redhat:rhel_eus:9.0", "package": "python3.9-0:3.9.10-4.el9_0.1", "product_name": "Red Hat Enterprise Linux 9.0 Extended Update Support", "release_date": "2023-07-18T00:00:00Z"}, {"advisory": "RHSA-2023:6793", "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7", "package": "rh-python38-python-0:3.8.18-2.el7", "product_name": "Red Hat Software Collections for Red Hat Enterprise Linux 7", "release_date": "2023-11-08T00:00:00Z"}, {"advisory": "RHSA-2023:4282", "cpe": "cpe:/o:redhat:rhev_hypervisor:4.4::el8", "package": "redhat-virtualization-host-0:4.5.3-202307191258_8.6", "product_name": "Red Hat Virtualization 4 for Red Hat Enterprise Linux 8", "release_date": "2023-07-26T00:00:00Z"}], "bugzilla": {"description": "python: urllib.parse url blocklisting bypass", "id": "2173917", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2173917"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.5", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N", "status": "verified"}, "cwe": "CWE-20", "details": ["An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.", "A flaw was found in the Python package. An issue in the urllib.parse component could allow attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.This may lead to compromised Integrity."], "name": "CVE-2023-24329", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "gimp:flatpak/python2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "inkscape:flatpak/python2", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "python36:3.6/python36", "product_name": "Red Hat Enterprise Linux 8"}], "public_date": "2023-02-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-24329\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-24329\nhttps://pointernull.com/security/python-url-parse-problem.html"], "statement": "Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide \"symlinks\" to the main python3 component, which provides the actual interpreter of the Python programming language.", "threat_severity": "Important", "upstream_fix": "python 3.11"}