Summary
Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-11168: The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser. CVE-2023-24329: An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
Fixed packages 9
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux · 2023 | python3.11 | 0:3.11.6-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.11-debug | 0:3.11.6-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.11-debuginfo | 0:3.11.6-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.11-debugsource | 0:3.11.6-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.11-devel | 0:3.11.6-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.11-idle | 0:3.11.6-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.11-libs | 0:3.11.6-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.11-test | 0:3.11.6-1.amzn2023.0.1 |
| Amazon Linux · 2023 | python3.11-tkinter | 0:3.11.6-1.amzn2023.0.1 |
Vulnerabilities 2
-
High 7.5
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by suppl…
-
Medium 6.3
Improper validation of IPv6 and IPvFuture addresses
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one U…