Description
WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Pylons | webob | <= 1.8.7 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | python-webob | 1:1.8.9-1 | — |
| Debian 13 | python-webob | 1:1.8.9-1 | — |
| Debian 12 | python-webob | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.04 LTS | python-webob | 1:1.8.9-1ubuntu0.1 | USN-8759-1 |
| Ubuntu 24.04 LTS | python-webob | 1:1.8.7-1ubuntu0.1.24.04.1 | USN-8759-1, USN-6984-1 |
| Ubuntu 22.04 LTS | python-webob | 1:1.8.6-1.1ubuntu0.1 | USN-8759-1, USN-6984-1 |
| Ubuntu 20.04 LTS | python-webob | 1:1.8.5-2ubuntu0.1 | USN-6984-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 20.04 LTS | python-webob | 1:1.8.5-2ubuntu0.1+esm1 | USN-8759-1 |
| Ubuntu Pro 18.04 LTS | python-webob | 1:1.7.3-2ubuntu0.1~esm2 | USN-8759-1 |
| Ubuntu Pro 16.04 LTS | python-webob | 1.5.1-1ubuntu0.1~esm2 | USN-8759-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Openshift Ironic 4 | openstack-ironic +5 | 1:21.3.1-0.20240911165036.c0d61d0.el9 | RHSA-2024:7941 |
| Red Hat Openshift Ironic 4 | python-webob +1 | 1.8.8-2.el9 | RHSA-2024:7941, RHSA-2024:7187, RHSA-2024:7182 |
| Red Hat OpenStack 18 | python-webob +1 | 1.8.7-3.el9ost | RHSA-2024:6775 |
| Red Hat OpenStack 17 | python-webob +1 | 1.8.7-2.1.el8ost | RHSA-2024:9989, RHSA-2024:9983 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | podman +6 | 3:4.4.1-13.rhaos4.13.el8 | RHSA-2024:7941, RHSA-2024:7187, RHSA-2024:7182 |
| Red Hat OpenShift 4 | skopeo +1 | 2:1.11.3-3.rhaos4.13.el8 | RHSA-2024:7941, RHSA-2024:7187, RHSA-2024:7182 |
| Red Hat Ceph Storage 8 | ceph +27 | 2:19.2.1-222.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 8 | cephadm-ansible | 1:4.1.4-1.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 8 | liboath +1 | 2.6.12-1.el9cp | RHSA-2025:9775 |
| Red Hat Ceph Storage 7 | ceph +25 | 2:18.2.1-329.el8cp | RHSA-2025:4664 |
| Red Hat Ceph Storage 7 | cephadm | 2:18.2.1-329.el9cp | RHSA-2025:4664 |
| Red Hat Ceph Storage 7 | liboath +1 | 2.6.12-1.el8cp | RHSA-2025:4664 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | python-WebOb | 1.7.4-150000.3.3.1 | SUSE-SU-2024:3116-1 |
| SLES 15 SP5 | python-WebOb | 1.7.4-150000.3.3.1 | SUSE-SU-2024:3116-1 |
| SLES 12 | python-WebOb | 1.2.3-3.3.1 | SUSE-SU-2024:2969-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-WebOb | 1.8.8-1.1 | openSUSE-SU-2024:14279-1 |
| openSUSE Leap 15.6 | python-WebOb | 1.8.7-150400.11.6.1 | SUSE-SU-2024:2970-1 |
| openSUSE Leap 15.5 | python-WebOb | 1.7.4-150000.3.3.1 | SUSE-SU-2024:3116-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | python-webob | 1.2.3-7.amzn2.0.1 | ALAS2-2025-2726 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | python-webob | 1.8.8-1 | — |
| Azure Linux 2 (CBL-Mariner) | python-webob | 1.8.8-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | webob | < 1.8.8 | 1.8.8 | GHSA-mg3v-6m49-jhp3 |
Advisories 17
- RHSA-2025:4664 Red Hat Security Advisory: Red Hat Ceph Storage 7.1 security, bug fix, and enhancement updates Red Hat Security Advisories (RHSA) · Oct 17, 2026
- RHSA-2025:9775 Red Hat Security Advisory: Red Hat Ceph Storage 8.1 security, bug fix, and enhancement updates Red Hat Security Advisories (RHSA) · Oct 16, 2026
- RHSA-2024:7941 Red Hat Security Advisory: OpenShift Container Platform 4.13.z security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:7187 Red Hat Security Advisory: OpenShift Container Platform 4.14.38 security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- RHSA-2024:7182 Red Hat Security Advisory: OpenShift Container Platform 4.15.35 packages and security update Red Hat Security Advisories (RHSA) · Oct 14, 2026
- USN-8759-1 python-webob vulnerabilities Ubuntu Security Notices (USN) · Sep 16, 2026
- WID-SEC-2024-2183 Red Hat Enterprise Linux: Schwachstelle ermöglicht Darstellen falscher Informationen BSI CERT-Bund (WID) · Sep 15, 2026
- RHSA-2024:9989 Red Hat Security Advisory: RHOSP 17.1.4 (python-webob) security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:9983 Red Hat Security Advisory: RHOSP 17.1.4 (python-webob) security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:6775 Red Hat Security Advisory: Red Hat OpenStack Platform 18.0 (python-webob) security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- RHSA-2024:6827 Red Hat Security Advisory: OpenShift Container Platform 4.16.14 security update Red Hat Security Advisories (RHSA) · Aug 19, 2026
- USN-6984-1 python-webob vulnerability Ubuntu Security Notices (USN) · Apr 27, 2026
- openSUSE-SU-2024:14279-1 python-WebOb-doc-1.8.8-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2969-1 Security update for python-WebOb SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:3116-1 Security update for python-WebOb SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2024:2970-1 Security update for python-WebOb SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2025-2726 Moderate: python-webob security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Jan 9, 2025