Fluid Attacks Database

Description

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts ([]), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	python3.11	=3.11.2-6 \|\| =3.11.2-6+deb12u1 \|\| =3.11.2-6+deb12u2 \|\| =3.11.2-6+deb12u3 \|\| =3.11.2-6+deb12u4 \|\| >=0 <3.11.2-6+deb12u5	3.11.2-6+deb12u5
debian 14	pypy3	>=0 <7.3.18+dfsg-1	7.3.18+dfsg-1
debian 12	pypy3	=7.3.11+dfsg-2 \|\| =7.3.11+dfsg-2+deb12u1 \|\| =7.3.11+dfsg-2+deb12u2 \|\| =7.3.11+dfsg-2+deb12u3 \|\| =7.3.12+dfsg-1 \|\| =7.3.12~rc1+dfsg-1 \|\| =7.3.12~rc2+dfsg-1 \|\| =7.3.13+dfsg-1 \|\| =7.3.14+dfsg-1 \|\| =7.3.15+dfsg-1 \|\| =7.3.16+dfsg-1 \|\| =7.3.16+dfsg-2 \|\| =7.3.17+dfsg-1 \|\| =7.3.17+dfsg-2 \|\| =7.3.17+dfsg-3 \|\| =7.3.18+dfsg-1 \|\| =7.3.18+dfsg-2 \|\| =7.3.19+dfsg-1 \|\| =7.3.19+dfsg-2 \|\| =7.3.20+dfsg-1 \|\| =7.3.20+dfsg-2 \|\| =7.3.20+dfsg-3 \|\| =7.3.20+dfsg-4 \|\| =7.3.21+dfsg-1 \|\| =7.3.21+dfsg-2 \|\| =7.3.21+dfsg-3 \|\| =7.3.21+dfsg-4 \|\| =7.3.22+dfsg-1 \|\| =7.3.23+dfsg-1 \|\| =7.3.23+dfsg-2	-
debian 13	pypy3	>=0 <7.3.18+dfsg-1	7.3.18+dfsg-1
rpm rhel8	python39	<0:3.9.25-2.module+el8.10.0+23718+1842ae33	0:3.9.25-2.module+el8.10.0+23718+1842ae33
rpm rhel8	python3	<0:3.6.8-69.el8_10	0:3.6.8-69.el8_10
rpm rhel9	python3.9	<0:3.9.21-1.el9_5	0:3.9.21-1.el9_5
rpm rhel8	python39-devel	<0:3.9.25-2.module+el8.10.0+23718+1842ae33	0:3.9.25-2.module+el8.10.0+23718+1842ae33
pypi	python	>=0 <3.9.21 \|\| >=3.10.0 <3.10.16 \|\| >=3.11.0 <3.11.4 \|\| >=3.12.0a1 <3.12.0b1	3.9.21, 3.10.16, 3.11.4, 3.12.0b1

Aliases

1. CVE-2024-111682. NVD-2024-111683. OSV-DEBIAN-2024-111684. OSV-2024-111685. GCVE-2024-111686. SECURITY-TRACKER-CVE-2024-111687. lists.debian.org8. https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/11xxx/CVE-2024-11168.json9. mail.python.org10. security.netapp.com

References

1. https://github.com/python/cpython/issues/1038482. https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c53. https://github.com/python/cpython/commit/634ded45545ce8cbd6fd5d49785613dd7fa9b89e4. https://github.com/python/cpython/commit/b2171a2fd41416cf68afd67460578631d755a5505. https://github.com/python/cpython/commit/ddca2953191c67a12b1f19d6bca41016c6ae71326. https://github.com/python/cpython/pull/103849

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.