Moderate Security Vulnerability in Python 3.9: URL Parser Issue
Summary
ALSA-2025:6977: Moderate: python3.9 security update. Affects python-unversioned-command versions < 3.9.21-2.el9. Fixed in 3.9.21-2.el9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used interpreted, interactive, object-oriented programming language known for its simplicity and versatility. It supports various system calls, libraries, and windowing systems, making it a popular choice for developers. The specific vulnerability affects the URL parser in Python 3.9, which improperly allows square brackets in domain names, potentially leading to security risks.
Vulnerability Detail
The vulnerability, identified as CVE-2025-0938, arises from the URL parser in Python's cpython implementation. It permits square brackets in domain names, which can be exploited by attackers to craft malicious URLs that may bypass security checks. This could lead to various attacks, including phishing or data leakage, as the parser fails to validate domain names correctly.
How To Fix
Minimum fixed version
3.9.21-2.el9
This is the first release that contains the fix.
sudo dnf update python-unversioned-commandTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using URLs that contain square brackets in domain names until the package is updated to the fixed version.
Conclusion
The vulnerability in Python 3.9's URL parser poses a moderate security risk by allowing square brackets in domain names. It is crucial to update to the patched version to mitigate potential threats. Users should also consider using Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for python-unversioned-command →
FAQ
CVE-2025-0938 is a security vulnerability in Python 3.9 that allows square brackets in domain names, potentially leading to security risks.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The risks include potential phishing attacks and data leakage due to improper validation of URLs containing square brackets.
If immediate updates are not possible, avoid using URLs with square brackets in domain names as a temporary measure.
For more details, refer to the CVE page associated with CVE-2025-0938 and the AlmaLinux Release Notes.
Related vulnerabilities
Recent vulnerabilities recorded for python-unversioned-command.
