NotificationsYou must be signed in to change notification settings
Fork32k
Star67.2k

[3.10] gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (#103849)#126975

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to ourterms of service andprivacy statement. We’ll occasionally send you account related emails.

Already on GitHub?Sign in to your account

Jump to bottom

Merged

ambv merged 1 commit intopython:3.10fromvstinner:urlsplit10

Dec 2, 2024

Merged

[3.10] gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (#103849)#126975

ambv merged 1 commit intopython:3.10fromvstinner:urlsplit10

Dec 2, 2024

Conversation

Copy link

Member

vstinner commentedNov 18, 2024•
edited by bedevere-appbot
Loading

Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format

Co-authored-by: Gregory P. Smithgreg@krypto.org
(cherry picked from commit29f348e)

Issue:[CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets #103848

pythongh-103848: Adds checks to ensure that bracketed hosts found by …

ab6f221

…urlsplit are of IPv6 or IPvFuture format (python#103849)* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format---------Co-authored-by: Gregory P. Smith <greg@krypto.org>(cherry picked from commit29f348e)

bedevere-appbot added type-bug

An unexpected behavior, bug, or error

awaiting core review labels

Nov 18, 2024

This was referencedNov 18, 2024

gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format#103849

Merged

[CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets#103848

Closed

Copy link

MemberAuthor

vstinner commentedNov 19, 2024

@gpshead: Would you mind to proof-read this backport PR to 3.10? I had a minor conflictLib/urllib/parse.py becauseurlsplit() has a decorator on Python 3.11 and newer.

gpshead approved these changes

Nov 19, 2024

View reviewed changes

bedevere-appbot added awaiting merge and removed awaiting core review labels

Nov 19, 2024

Copy link

MemberAuthor

vstinner commentedNov 20, 2024

@pablogsal,@ambv: Would you mind to review/merge this security fix?

jamie-albert mentioned this pull request

Nov 27, 2024

python-3.10/CVE-2024-11168 advisory updatewolfi-dev/advisories#9252

Merged

Copy link

MemberAuthor

vstinner commentedNov 28, 2024

@pablogsal,@ambv: Gentle reminder. Would you mind to review/merge this security fix? It would be nice to get this fix in the next batch of security releases (December 3rd).