Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format#103849

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Merged
gpshead merged 4 commits intopython:mainfromJohnJamesUtley:fix-issue-using-ipmodule
May 10, 2023

Conversation

JohnJamesUtley
Copy link
Contributor

@JohnJamesUtleyJohnJamesUtley commentedApr 25, 2023•
edited by bedevere-bot
Loading

@ghost
Copy link

ghost commentedApr 25, 2023•
edited by ghost
Loading

All commit authors signed the Contributor License Agreement.
CLA signed

@bedevere-bot
Copy link

Most changes to Pythonrequire a NEWS entry.

Please add it using theblurb_it web app or theblurb command-line tool.

@gpsheadgpshead self-assigned thisMay 9, 2023
@bedevere-bot
Copy link

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phraseI have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@JohnJamesUtley
Copy link
ContributorAuthor

I have made the requested changes; please review again

You're correct that.rpartition(']') was unnecessary here so I changed it back to the original.partition(']'). I originally changed it because it seemed cleaner to me but it isn't necessary to fix this issue.

@bedevere-bot
Copy link

Thanks for making the requested changes!

@gpshead: please review the changes made to this pull request.

@bedevere-botbedevere-bot requested a review fromgpsheadMay 9, 2023 20:32
@gpsheadgpshead added type-bugAn unexpected behavior, bug, or error needs backport to 3.11only security fixes labelsMay 9, 2023
@gpsheadgpsheadenabled auto-merge (squash)May 9, 2023 23:54
@gpsheadgpshead merged commit29f348e intopython:mainMay 10, 2023
@miss-islington
Copy link
Contributor

Thanks@JohnJamesUtley for the PR, and@gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

gpshead added a commit that referenced this pull requestMay 10, 2023
… urlsplit are of IPv6 or IPvFuture format (GH-103849) (#104349)gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (GH-103849)* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format---------(cherry picked from commit29f348e)Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
carljm added a commit to carljm/cpython that referenced this pull requestMay 10, 2023
* main:pythonGH-102181: Improve specialization stats for SEND (pythonGH-102182)pythongh-103000: Optimise `dataclasses.asdict` for the common case (python#104364)pythongh-103538: Remove unused TK_AQUA code (pythonGH-103539)pythonGH-87695: Fix OSError from `pathlib.Path.glob()` (pythonGH-104292)pythongh-104263: Rely on Py_NAN and introduce Py_INFINITY (pythonGH-104202)pythongh-104010: Separate and improve docs for `typing.get_origin` and `typing.get_args` (python#104013)pythongh-101819: Adapt _io._BufferedIOBase_Type methods to Argument Clinic (python#104355)pythongh-103960: Dark mode: invert image brightness (python#103983)pythongh-104252: Immortalize Py_EMPTY_KEYS (pythongh-104253)pythongh-101819: Clean up _io windows console io afterpythongh-104197 (python#104354)pythongh-101819: Harden _io init (python#104352)pythongh-103247: clear the module cache in a test in test_importlib/extensions/test_loader.py (pythonGH-104226)pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (python#103849)pythongh-74895: adjust tests to work on Solaris (python#104326)pythongh-101819: Refactor _io in preparation for module isolation (python#104334)pythongh-90953: Don't use deprecated AST nodes in clinic.py (python#104322)pythongh-102327: Extend docs for "url" and "headers" parameters to HTTPConnection.request()pythongh-104328: Fix typo in ``typing.Generic`` multiple inheritance error message (python#104335)
frenzymadness pushed a commit to frenzymadness/cpython that referenced this pull requestNov 13, 2024
…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349)pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format---------(cherry picked from commit29f348e)Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
frenzymadness added a commit to frenzymadness/cpython that referenced this pull requestNov 14, 2024
…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349)pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture formatTests are adjusted because Python <3.9 don't support scoped IPv6 addresses.(cherry picked from commit29f348e)Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
frenzymadness added a commit to frenzymadness/cpython that referenced this pull requestNov 14, 2024
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.(cherry picked from commit29f348e)Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
frenzymadness added a commit to fedora-python/cpython that referenced this pull requestNov 14, 2024
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.(cherry picked from commit29f348e)Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
vstinner pushed a commit to vstinner/cpython that referenced this pull requestNov 18, 2024
…urlsplit are of IPv6 or IPvFuture format (python#103849)* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format---------Co-authored-by: Gregory P. Smith <greg@krypto.org>(cherry picked from commit29f348e)
@bedevere-app
Copy link

GH-126975 is a backport of this pull request to the3.10 branch.

vstinner pushed a commit to vstinner/cpython that referenced this pull requestNov 18, 2024
…urlsplit are of IPv6 or IPvFuture format (python#103849)* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format---------Co-authored-by: Gregory P. Smith <greg@krypto.org>(cherry picked from commit29f348e)
@bedevere-app
Copy link

GH-126976 is a backport of this pull request to the3.9 branch.

@BitterDone
Copy link

Hi@miss-islington and@gpshead - how do I ensure I'm using a version of Python with this vulnerability fixed?

I'm supporting a team that uses hardened containers from Iron Bank and I don't believe the approved containers will get the back port updates.

Since 3.11 is the newest version mentioned here for a back port, does the initial release of 3.12 include this fix?

@CharlieZhao95
Copy link
Contributor

Since 3.11 is the newest version mentioned here for a back port, does the initial release of 3.12 include this fix?

The release date of Pyton3.12 is 2023-10, so of course, 3.12 contains this patch. BTW miss-islington is a bot for PR. 😉

BitterDone reacted with heart emoji

ambv pushed a commit that referenced this pull requestDec 2, 2024
…urlsplit are of IPv6 or IPvFuture format (#103849) (#126976)Co-authored-by: Gregory P. Smith <greg@krypto.org>(cherry picked from commit29f348e)Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
ambv pushed a commit that referenced this pull requestDec 2, 2024
… urlsplit are of IPv6 or IPvFuture format (#103849) (#126975)Co-authored-by: Gregory P. Smith <greg@krypto.org>(cherry picked from commit29f348e)Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
sarahboyce pushed a commit to felixxm/django that referenced this pull requestDec 3, 2024
…ly validate IPv6 and IPvFuture addresses.Refs PythonCVE-2024-11168. Django should not affected, but others whoincorrectly use internal function _urlsplit() with unsanitized inputcould be at risk.python/cpython#103849
sarahboyce pushed a commit to django/django that referenced this pull requestDec 3, 2024
…ly validate IPv6 and IPvFuture addresses.Refs PythonCVE-2024-11168. Django should not affected, but others whoincorrectly use internal function _urlsplit() with unsanitized inputcould be at risk.python/cpython#103849
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull requestApr 9, 2025
…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349)pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format---------(cherry picked from commit29f348e)Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>
hrnciar pushed a commit to fedora-python/cpython that referenced this pull requestApr 23, 2025
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.(cherry picked from commit29f348e)Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>Co-authored-by: Gregory P. Smith <greg@krypto.org>Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
Sign up for freeto join this conversation on GitHub. Already have an account?Sign in to comment
Reviewers

@gpsheadgpsheadgpshead approved these changes

Assignees

@gpsheadgpshead

Labels
stdlibPython modules in the Lib dirtype-bugAn unexpected behavior, bug, or error
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

8 participants
@JohnJamesUtley@bedevere-bot@miss-islington@BitterDone@CharlieZhao95@gpshead@arhadthedev@JamesJohnUtley
[8]ページ先頭
©2009-2025 Movatter.jp