Fluid Attacks Database

Description

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 14	pypy3	>=0 <7.3.12+dfsg-1	7.3.12+dfsg-1
debian 12	pypy3	=7.3.11+dfsg-2 \|\| =7.3.11+dfsg-2+deb12u1 \|\| >=0 <7.3.11+dfsg-2+deb12u2	7.3.11+dfsg-2+deb12u2
debian 13	pypy3	>=0 <7.3.12+dfsg-1	7.3.12+dfsg-1
debian 12	python3.11	=3.11.2-6 \|\| =3.11.2-6+deb12u1 \|\| >=0 <3.11.2-6+deb12u2	3.11.2-6+deb12u2
rpm rhel8	python39	<0:3.9.16-1.module+el8.8.0+18968+3d7b19f0.1	0:3.9.16-1.module+el8.8.0+18968+3d7b19f0.1
rpm rhel9.0	python3.9	<0:3.9.10-4.el9_0.1	0:3.9.10-4.el9_0.1
rpm rhel8	python38	<0:3.8.16-1.module+el8.8.0+18967+20d359ae.1	0:3.8.16-1.module+el8.8.0+18967+20d359ae.1
rpm rhel8.6	python38	<0:3.8.12-1.module+el8.6.0+19204+eee15c0a.2	0:3.8.12-1.module+el8.6.0+19204+eee15c0a.2
rpm rhel7	python3	<0:3.6.8-19.el7_9	0:3.6.8-19.el7_9
rpm rhel8.6	python3	<0:3.6.8-47.el8_6.1	0:3.6.8-47.el8_6.1

1-10 of 22

Aliases

References

1. https://github.com/H4R335HR/CVE-2023-24329-PoC2. https://pointernull.com/security/python-url-parse-problem.html3. https://github.com/python/cpython/issues/1021534. https://github.com/python/cpython/pull/99421

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.