CVE-2023-24329

2023-02-1715:15:12

Debian Security Bug Tracker

security-tracker.debian.org

python

3.11.4

urllib.parse

security issue

bypass blocklisting

blank characters

cve-2023-24329

unix

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

0.001 Low

EPSS

Percentile

41.6%

JSON

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

OSVersionArchitecturePackageVersionFilename
Debian12allpypy3< 7.3.11+dfsg-2+deb12u2pypy3_7.3.11+dfsg-2+deb12u2_all.deb
Debian11allpypy3<= 7.3.5+dfsg-2+deb11u2pypy3_7.3.5+dfsg-2+deb11u2_all.deb
Debian999allpypy3< 7.3.12+dfsg-1pypy3_7.3.12+dfsg-1_all.deb
Debian13allpypy3< 7.3.12+dfsg-1pypy3_7.3.12+dfsg-1_all.deb
Debian11allpython2.7< 2.7.18-8+deb11u1python2.7_2.7.18-8+deb11u1_all.deb
Debian12allpython3.11< 3.11.2-6+deb12u2python3.11_3.11.2-6+deb12u2_all.deb
Debian999allpython3.11< 3.11.4-1python3.11_3.11.4-1_all.deb
Debian13allpython3.11< 3.11.4-1python3.11_3.11.4-1_all.deb
Debian11allpython3.9<= 3.9.2-1python3.9_3.9.2-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	pypy3	< 7.3.11+dfsg-2+deb12u2	pypy3_7.3.11+dfsg-2+deb12u2_all.deb
Debian	11	all	pypy3	<= 7.3.5+dfsg-2+deb11u2	pypy3_7.3.5+dfsg-2+deb11u2_all.deb
Debian	999	all	pypy3	< 7.3.12+dfsg-1	pypy3_7.3.12+dfsg-1_all.deb
Debian	13	all	pypy3	< 7.3.12+dfsg-1	pypy3_7.3.12+dfsg-1_all.deb
Debian	11	all	python2.7	< 2.7.18-8+deb11u1	python2.7_2.7.18-8+deb11u1_all.deb
Debian	12	all	python3.11	< 3.11.2-6+deb12u2	python3.11_3.11.2-6+deb12u2_all.deb
Debian	999	all	python3.11	< 3.11.4-1	python3.11_3.11.4-1_all.deb
Debian	13	all	python3.11	< 3.11.4-1	python3.11_3.11.4-1_all.deb
Debian	11	all	python3.9	<= 3.9.2-1	python3.9_3.9.2-1_all.deb