BIT-python-2024-11168: Improper validation of IPv6 and IPvFuture addresses

Published Nov 12, 2024

Updated

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts ([]), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.

Affected Software

1 affected component

Python Software Foundation urllib.parse

Event History

Nov 12, 2024

CVE Published

via OSV·09:22 PM

Data Sourced

via OSV·09:22 PM

DescriptionSeverity

Frequently Asked Questions

When is this issue realistically exploitable?

It may enable SSRF when a URL is processed by more than one URL parser and the parsers interpret a bracketed host differently. The affected parsing behavior involves bracketed hosts that are not valid IPv6 or IPvFuture addresses.

Does exploitation require authentication or user interaction?

The supplied vector indicates no privileges and no user interaction are required. It also indicates network attack exposure, although exploitation has high attack complexity and requires an additional attack condition.

What should teams review if they cannot immediately update?

Review URL-handling paths that use urllib.parse.urlsplit() or urlparse() and then pass the URL to another parser or URL-consuming component. Pay particular attention to inputs containing bracketed hosts, because inconsistent parsing of those hosts is the condition described.

BIT-python-2024-11168: Improper validation of IPv6 and IPvFuture addresses

Affected Software

Event History

Frequently Asked Questions

When is this issue realistically exploitable?

Does exploitation require authentication or user interaction?

What should teams review if they cannot immediately update?

Company

Resources

Contact

Frequently Asked Questions

When is this issue realistically exploitable?

Does exploitation require authentication or user interaction?

What should teams review if they cannot immediately update?