Invalid Domain Name Handling in Python Standard Library - Vulnerability in python3
Summary
ALPINE-CVE-2025-0938: The Python standard library functions urllib.parse.urlsplit and urlparse accepted domain names that included square brackets which isn't valid according to RFC 3986. Affects python3 versions < 3.11.12-r0. Fixed in 3.11.12-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. The 'python3' package in Alpine Linux provides the Python 3 interpreter and standard library, enabling developers to build applications efficiently. However, certain functions in the standard library, specifically 'urllib.parse.urlsplit' and 'urlparse', have been found to improperly handle domain names containing square brackets, which are not compliant with RFC 3986. This vulnerability can lead to inconsistent URL parsing behavior across different parsers.
Vulnerability Detail
The vulnerability arises from the acceptance of domain names with square brackets in the Python standard library functions 'urllib.parse.urlsplit' and 'urlparse'. According to RFC 3986, square brackets should only be used as delimiters for IPv6 and IPvFuture hosts in URLs. This flaw can result in differential parsing, where the Python URL parser behaves differently than other specification-compliant URL parsers, potentially leading to security issues such as incorrect URL handling and data leakage.
How To Fix
Minimum fixed version
3.11.12-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using domain names with square brackets in your URLs when utilizing the 'urllib.parse.urlsplit' and 'urlparse' functions until the package is updated.
Conclusion
In summary, the vulnerability in the Python standard library functions 'urllib.parse.urlsplit' and 'urlparse' allows for improper handling of domain names with square brackets, leading to potential security risks. It is crucial to update the 'python3' package to the patched versions to mitigate these risks.
See every vulnerability recorded for python3 →
FAQ
The vulnerability can lead to inconsistent URL parsing, which may result in security issues such as incorrect URL handling and potential data leakage.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to access the code.
The affected versions include python3 in Alpine v3.18, v3.19, v3.20, v3.21, and v3.22 prior to the specified fixed versions.
Yes, as a temporary measure, avoid using domain names with square brackets in your URLs when using the affected functions.
You can find detailed information about this vulnerability in the CVE database or by visiting the Vulert website.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.