Lucene search
UbuntuUSN-6139-1HistoryJun 05, 2023 - 12:00 a.m.
Python vulnerability
2023-06-0500:00:00
ubuntu.com
39
ubuntu
python
security
vulnerability
urls
cve-2023-24329
bypassingblockinglisting
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
8.2 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
41.7%
Releases
- Ubuntu 23.04
- Ubuntu 22.10
- Ubuntu 22.04 LTS
- Ubuntu 20.04 LTS
- Ubuntu 18.04 ESM
- Ubuntu 16.04 ESM
- Ubuntu 14.04 ESM
Packages
- python2.7 - An interactive high-level object-oriented language
- python3.10 - An interactive high-level object-oriented language
- python3.11 - An interactive high-level object-oriented language
- python3.5 - An interactive high-level object-oriented language
- python3.6 - An interactive high-level object-oriented language
- python3.8 - An interactive high-level object-oriented language
Details
Yebo Cao discovered that Python incorrectly handled certain URLs.
An attacker could use this issue to bypass blockinglisting methods.
This issue was first addressed in USN-5960-1, but was incomplete.
Here we address an additional fix to that issue. (CVE-2023-24329)
| OS | Version | Architecture | Package | Version | Filename |
|---|---|---|---|---|---|
| Ubuntu | 23.04 | noarch | python3.11 | < 3.11.2-6ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | idle-python3.11 | < 3.11.2-6ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libpython3.11 | < 3.11.2-6ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libpython3.11-dbg | < 3.11.2-6ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libpython3.11-dev | < 3.11.2-6ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libpython3.11-minimal | < 3.11.2-6ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libpython3.11-stdlib | < 3.11.2-6ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | libpython3.11-testsuite | < 3.11.2-6ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | python3.11-dbg | < 3.11.2-6ubuntu0.1 | UNKNOWN |
| Ubuntu | 23.04 | noarch | python3.11-dev | < 3.11.2-6ubuntu0.1 | UNKNOWN |
References
Related
redhat
redhat
(RHSA-2023:3936) Important: python3 security update
2023-06-29 12:54:45
osv
osv
Important: python38:3.8 and python38-devel:3.8 security update
2023-06-22 00:00:00
Important: python39:3.9 and python39-devel:3.9 security update
2023-08-31 16:54:34
Important: python3 security update
2023-06-24 18:52:42
oraclelinux
oraclelinux
python3 security update
2023-06-12 00:00:00
python27:2.7 security update
2023-07-08 00:00:00
python38:3.8 and python38-devel:3.8 security update
2023-07-08 00:00:00
openvas
openvas
Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2023-2517)
2023-08-01 00:00:00
Huawei EulerOS: Security Advisory for python3 (EulerOS-SA-2023-3150)
2023-11-09 00:00:00
Fedora: Security Advisory for python3.9 (FEDORA-2023-b854908745)
2023-06-09 00:00:00
fedora
fedora
[SECURITY] Fedora 37 Update: pypy-7.3.11-2.fc37
2023-06-08 02:00:25
[SECURITY] Fedora 37 Update: python3.11-3.11.3-2.fc37
2023-05-27 01:26:58
[SECURITY] Fedora 37 Update: pypy3.9-7.3.11-2.3.9.fc37
2023-06-08 02:00:27
nessus
nessus
Oracle Linux 8 : python3 (ELSA-2023-3591)
2023-06-15 00:00:00
CentOS 9 : python3.11-3.11.4-3.el9
2024-02-29 00:00:00
Fedora 39 : python3.10 (2023-d1cdb80702)
2023-11-07 00:00:00
slackware
slackware
[slackware-security] python3
2023-06-09 01:28:03
rocky
rocky
python27:2.7 security update
2023-06-24 18:52:51
python3.11 security update
2023-08-31 16:54:34
python3.11 security update
2023-08-31 16:55:40
cloudlinux
cloudlinux
python: Fix of CVE-2023-24329
2023-07-20 20:54:04
python: Fix of CVE-2023-24329
2023-03-06 21:09:04
cert
cert
Python Parsing Error Enabling Bypass CVE-2023-24329
2023-08-11 00:00:00
cbl_mariner
cbl_mariner
CVE-2023-24329 affecting package python3 3.7.13-5
2023-03-16 03:40:27
CVE-2023-24329 affecting package python2 2.7.18-11
2023-03-16 03:40:27
CVE-2023-24329 affecting package python3 for versions less than 3.9.14-8
2023-10-13 16:12:18
centos
centos
python, tkinter security update
2023-07-27 14:34:23
almalinux
almalinux
Important: python39:3.9 and python39-devel:3.9 security update
2023-06-27 00:00:00
Important: python3 security update
2023-06-14 00:00:00
Important: python3.9 security update
2023-06-14 00:00:00
amazon
amazon
Medium: python3
2023-03-17 16:34:00
redhatcve
redhatcve
CVE-2023-24329
2023-02-28 12:29:51
cloudfoundry
cloudfoundry
USN-5960-1: Python vulnerability | Cloud Foundry
2023-04-29 00:00:00
USN-6139-1: Python vulnerability | Cloud Foundry
2023-10-05 00:00:00
debiancve
debiancve
CVE-2023-24329
2023-02-17 15:15:12
ibm
ibm
Security Bulletin: A vulnerability in Python may affect IBM Robotic Process Automation and result in a remote attacker bypassing security restrictions (CVE-2023-24329).
2023-11-22 20:55:44
ubuntucve
ubuntucve
CVE-2023-24329
2023-02-17 00:00:00
cvelist
cvelist
CVE-2023-24329
2023-02-17 00:00:00
ubuntu
ubuntu
Python vulnerability
2023-03-16 00:00:00
aix
aix
AIX is affected by security restrictions bypass due to Python
2023-08-18 09:49:04
thn
thn
New Python URL Parsing Flaw Could Enable Command Execution Attacks
2023-08-12 06:03:00
cgr
cgr
CVE-2023-24329 vulnerabilities
2024-05-19 03:07:16
cve
cve
CVE-2023-24329
2023-02-17 15:15:12
githubexploit
githubexploit
Exploit for Improper Input Validation in Python
2023-08-17 10:33:52
Exploit for Improper Input Validation in Python
2023-10-05 01:55:05
f5
f5
K000135921 : Python urllib.parse vulnerability CVE-2023-24329
2023-08-22 00:00:00
veracode
veracode
URL Whitespace Padding Attack
2023-10-09 01:33:29
7.5 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
HIGH
Availability Impact
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
8.2 High
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
41.7%
Related for USN-6139-1