CVE-2024-11168
Public on 2024-11-12
Modified on 2024-11-14
Description
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.
Severity
Low
CVSS v3 Base Score
See breakdown
Affected Packages
| Platform | Package | Release Date | Advisory | Status |
|---|---|---|---|---|
| Amazon Linux 2 - Core | python | Not Affected | ||
| Amazon Linux 1 | python27 | No Fix Planned | ||
| Amazon Linux 2 - Core | python3 | Pending Fix | ||
| Amazon Linux 2023 | python3.11 | Pending Fix | ||
| Amazon Linux 2023 | python3.9 | Pending Fix | ||
| Amazon Linux 1 | python38 | No Fix Planned |
CVSS Scores
| Score Type | Score | Vector | |
|---|---|---|---|
| Amazon Linux | CVSSv3 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |