Summary
Yebo Cao discovered that Python incorrectly handled certain URLs.
An attacker could use this issue to bypass blockinglisting methods.
This issue was first addressed in USN-5960-1, but was incomplete.
Here we address an additional fix to that issue. (CVE-2023-24329)
Fixed packages 7
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | python3.8 | 3.8.10-0ubuntu1~20.04.8 |
| Ubuntu · 22.04 LTS 22.04:LTS | python3.10 | 3.10.6-1~22.04.2ubuntu1.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python2.7 | 2.7.6-8ubuntu0.6+esm15 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python2.7 | 2.7.12-1ubuntu0~16.04.18+esm5 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python3.5 | 3.5.2-2ubuntu0~16.04.13+esm8 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python2.7 | 2.7.17-1~18.04ubuntu1.13 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.6 | 3.6.9-1~18.04ubuntu1.13 |
Vulnerabilities 1
-
High 7.5
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by suppl…
References
-
report
https://ubuntu.com/security/CVE-2023-24329