Medium USN-7218-1 1 CVE

python3.10, python3.8 vulnerability

Published Jan 20, 2025 · Updated Apr 27, 2026

Ecosystem: Ubuntu

Summary

It was discovered that Python incorrectly handled parsing bracketed hosts.
A remote attacker could possibly use this issue to perform a Server-Side
Request Forgery (SSRF) attack.

Fixed packages 2

Release	Package	Fixed in
Ubuntu · 20.04 LTS 20.04:LTS	python3.8	3.8.10-0ubuntu1~20.04.14
Ubuntu · 22.04 LTS 22.04:LTS	python3.10	3.10.12-1~22.04.8

Vulnerabilities 1

Medium 6.3

CVE-2024-11168

Improper validation of IPv6 and IPvFuture addresses

The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one U…

Python Software Foundation CPython python3.4 python3.5 Debian Ubuntu Azure Linux Wolfi

Nov 12, 2024

References

report
https://ubuntu.com/security/CVE-2024-11168