High USN-5960-1 1 CVE

python2.7, python3.10, python3.5, python3.6, python3.8 vulnerability

Published Mar 16, 2023 · Updated Jun 29, 2026

Ecosystem: Ubuntu

Summary

Yebo Cao discovered that Python incorrectly handled certain URLs.
An attacker could possibly use this issue to bypass blocklisting
methods by supplying a URL that starts with blank characters.

Fixed packages 7

Release	Package	Fixed in
Ubuntu · 18.04 LTS 18.04:LTS	python2.7	2.7.17-1~18.04ubuntu1.11
Ubuntu · 18.04 LTS 18.04:LTS	python3.6	3.6.9-1~18.04ubuntu1.12
Ubuntu · 20.04 LTS 20.04:LTS	python3.8	3.8.10-0ubuntu1~20.04.7
Ubuntu · 22.04 LTS 22.04:LTS	python3.10	3.10.6-1~22.04.2ubuntu1
Ubuntu · Pro 14.04 LTS Pro:14.04:LTS	python2.7	2.7.6-8ubuntu0.6+esm14
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	python2.7	2.7.12-1ubuntu0~16.04.18+esm4
Ubuntu · Pro 16.04 LTS Pro:16.04:LTS	python3.5	3.5.2-2ubuntu0~16.04.13+esm7

Vulnerabilities 1

High 7.5

CVE-2023-24329 Public exploit EPSS 20%

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by suppl…

python3.4 python3.5 python2.7 python3.6 Debian Ubuntu Azure Linux

Feb 17, 2023

References

report
https://ubuntu.com/security/CVE-2023-24329