Description
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Python Software Foundation CPython
Default version status: unaffected
0 to < 3.9.21affected3.10.0 to < 3.10.16affected3.11.0 to < 3.11.4affected3.12.0a1 to < 3.12.0b1affected
References
- https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c5 ↗
- https://github.com/python/cpython/pull/103849 ↗
- https://github.com/python/cpython/issues/103848 ↗
- https://mail.python.org/archives/list/security-announce@python.org/thread/XPWB6XVZ5G5KGEI63M4AWLIEUF5BPH4T/ ↗
- https://github.com/python/cpython/commit/b2171a2fd41416cf68afd67460578631d755a550 ↗
- https://github.com/python/cpython/commit/634ded45545ce8cbd6fd5d49785613dd7fa9b89e ↗
- https://github.com/python/cpython/commit/ddca2953191c67a12b1f19d6bca41016c6ae7132 ↗
- https://security.netapp.com/advisory/ntap-20250411-0004/ ↗
- https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html ↗