CVE-2024-11168

medium

Published 2024-12-12 · Modified 2024-12-16

💬 Discuss on Community ✚ Propose mitigation

CVSS v3

—

CVSS v4 NEW

—

not yet in upstream

VIR risk

5.5

Description

Moderate: python3.9:3.9.21 security update

Predictions

Exploit likelihood

20%

Patch ETA

—

Heuristic predictions, AS-IS, for prioritization only.

Mitigations

Mitigation details

Source: Debian Security Tracker · View original ↗ · DFSG

CVE-2024-11168 NameCVE-2024-11168 DescriptionThe urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat,…

CVE-2024-11168

Name	CVE-2024-11168
Description	The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DLA-3980-1, DLA-4354-1

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
pypy3 (PTS)	bullseye	7.3.5+dfsg-2+deb11u2	vulnerable
	bullseye (security)	7.3.5+dfsg-2+deb11u5	fixed
	bookworm	7.3.11+dfsg-2+deb12u3	vulnerable
	trixie	7.3.19+dfsg-2	fixed
	forky	7.3.22+dfsg-1	fixed
	sid	7.3.23+dfsg-1	fixed
python3.11 (PTS)	bookworm	3.11.2-6+deb12u7	fixed
	bookworm (security)	3.11.2-6+deb12u3	vulnerable
python3.9 (PTS)	bullseye	3.9.2-1	vulnerable
	bullseye (security)	3.9.2-1+deb11u7	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin
pypy3	source	bullseye	7.3.5+dfsg-2+deb11u5	DLA-4354-1
pypy3	source	(unstable)	7.3.18+dfsg-1
python3.11	source	bookworm	3.11.2-6+deb12u5
python3.11	source	(unstable)	3.11.4-1
python3.12	source	(unstable)	(not affected)
python3.9	source	bullseye	3.9.2-1+deb11u2	DLA-3980-1
python3.9	source	(unstable)	(unfixed)

Notes

- python3.12 <not-affected> (Fixed with first upload to Debian unstable)
[bookworm] - pypy3 <no-dsa> (Minor issue)
https://github.com/python/cpython/issues/103848
https://github.com/python/cpython/pull/103849
https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c5 (v3.12.0b1)
https://github.com/python/cpython/commit/b2171a2fd41416cf68afd67460578631d755a550 (v3.11.4)

Home - Debian Security - Source (Git)

Apply commands

text fix

Notes

- python3.12 <not-affected> (Fixed with first upload to Debian unstable)[bookworm] - pypy3 <no-dsa> (Minor issue)https://github.com/python/cpython/issues/103848https://github.com/python/cpython/pull/103849https://github.com/python/cpython/commit/29f348e232e82938ba2165843c448c2b291504c5 (v3.12.0b1)https://github.com/python/cpython/commit/b2171a2fd41416cf68afd67460578631d755a550 (v3.11.4)

OS impact

OS	Version	Status	Fixed in
rocky	8	fixed
rhel	9	fixed
sles		affected
debian	bullseye	fixed	`7.3.5+dfsg-2+deb11u5`
debian	forky	fixed	`7.3.18+dfsg-1`
debian	sid	fixed	`7.3.18+dfsg-1`
debian	trixie	fixed	`7.3.18+dfsg-1`
debian	bookworm	fixed	`3.11.2-6+deb12u5`
almalinux	9	fixed	`python3-devel-3.9.21-1.el9_5.aarch64.rpm`
rocky	9	fixed

References

Community-verified mitigations for this CVE will appear above when contributors publish them.

Verify integrity in audit chain (admin only). AS-IS.