Summary
USN-7280-1 fixed a vulnerability in Python. This update provides the
corresponding updates for some additional Python packages in Ubuntu
releases.
Original advisory details:
It was discovered that Python incorrectly handled parsing domain names
that included square brackets. A remote attacker could possibly use
this issue to perform a Server-Side Request Forgery (SSRF) attack.
Fixed packages 11
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python2.7 | 2.7.6-8ubuntu0.6+esm25 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | python3.4 | 3.4.3-1ubuntu1~14.04.7+esm15 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | python2.7 | 2.7.12-1ubuntu0~16.04.18+esm16 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python2.7 | 2.7.17-1~18.04ubuntu1.13+esm11 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.6 | 3.6.9-1~18.04ubuntu1.13+esm4 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.7 | 3.7.5-2ubuntu1~18.04.2+esm5 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | python3.8 | 3.8.0-3ubuntu1~18.04.2+esm4 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python2.7 | 2.7.18-1~20.04.7+esm7 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | python3.9 | 3.9.5-3ubuntu0~20.04.1+esm4 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python2.7 | 2.7.18-13ubuntu1.5+esm6 |
| Ubuntu · Pro 22.04 LTS Pro:22.04:LTS | python3.11 | 3.11.0~rc1-1~22.04.1~esm3 |
Vulnerabilities 1
-
Medium 6.3
URL parser allowed square brackets in domain names
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture…
References
-
report
https://ubuntu.com/security/CVE-2025-0938