Vulnerability CVE-2023-24329: Information

Description

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Severity: HIGH (7.5) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

URL: https://nvd.nist.gov/vuln/detail/CVE-2023-24329
Published: Feb. 17, 2023
Modified: Nov. 7, 2023
Error type identifier: CWE-20

Fixed packages

Package name
Branch
Fixed in version
Version from repository
Errata ID
Task #
State
python3sisyphus3.11.0-alt13.12.2-alt1ALT-PU-2023-1951-1311250Fixed
python3sisyphus_e2k3.11.4-alt13.12.2-alt1ALT-PU-2023-3859-1-Fixed
python3sisyphus_riscv643.11.0-alt13.12.2-alt1ALT-PU-2023-3923-1-Fixed
python3p103.9.18-alt13.9.18-alt1ALT-PU-2024-2511-3340781Fixed
python3p10_e2k3.9.18-alt13.9.18-alt1ALT-PU-2024-3765-1-Fixed
python3p93.7.17-alt13.7.17-alt1ALT-PU-2024-2598-2340935Fixed
python3c10f13.9.18-alt0.c10f1.13.9.18-alt0.c10f1.1ALT-PU-2024-6382-3344932Fixed
python3c9f23.7.17-alt13.7.17-alt1ALT-PU-2024-3474-2342077Fixed

References to Advisories, Solutions, and Tools

Hyperlink
Resource
https://pointernull.com/security/python-url-parse-problem.html
  • Exploit
  • Mitigation
  • Technical Description
  • Third Party Advisory
https://github.com/python/cpython/pull/99421
  • Patch
https://security.netapp.com/advisory/ntap-20230324-0004/
  • Third Party Advisory
https://github.com/python/cpython/issues/102153
  • Issue Tracking
VU#127587
    [debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update
      FEDORA-2023-b3a3df39dd
        FEDORA-2023-406c1c6ed7
          FEDORA-2023-1092538441
            FEDORA-2023-63c69aa712
              FEDORA-2023-96aa33f0d3
                FEDORA-2023-953c2607d8
                  FEDORA-2023-2b25dd2a11
                    FEDORA-2023-994ecd7dbc
                      FEDORA-2023-690e150a39
                        FEDORA-2023-81bb8e3b99
                          FEDORA-2023-d8b0003ecd
                            FEDORA-2023-56cefa23df
                              FEDORA-2023-31888c4781
                                FEDORA-2023-acdfd145f2
                                  FEDORA-2023-03599274db
                                    FEDORA-2023-b854908745
                                      FEDORA-2023-d294ef140e
                                        FEDORA-2023-309cadedc6
                                          FEDORA-2023-401947eb94
                                            FEDORA-2023-f52390b9d2
                                              FEDORA-2023-dd526ed2e4

                                                  1. Configuration 1

                                                    cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
                                                    Start including
                                                    3.10.0
                                                    End excliding
                                                    3.10.12
                                                    cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
                                                    Start including
                                                    3.9.0
                                                    End excliding
                                                    3.9.17
                                                    cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
                                                    Start including
                                                    3.8.0
                                                    End excliding
                                                    3.8.17
                                                    cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
                                                    End excliding
                                                    3.7.17
                                                    cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
                                                    Start including
                                                    3.11.0
                                                    End excliding
                                                    3.11.4

                                                    Configuration 2

                                                    cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
                                                    cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
                                                    cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*

                                                    Configuration 3

                                                    cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
                                                    cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
                                                    cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
                                                    cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
                                                    cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*
                                                VKontakte|Telegram|YouTube|Forum|GitHub|Bugzilla
                                                Version: v24.5.1
                                                Back to top