Improper URL Host Validation in Python Packages - CVE-2024-11168
Summary
UBUNTU-CVE-2024-11168: The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts ([]), allowing hosts that weren't IPv6 or IPvFuture. Affects python2.7 versions < 2.7.6-8ubuntu0.6+esm28. Fixed in 2.7.6-8ubuntu0.6+esm28. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The affected packages, including python2.7, python3.4, python3.5, python3.6, python3.7, python3.8, python3.9, and python3.10, are part of the Python programming language ecosystem used for various applications ranging from web development to data analysis. These packages provide essential functionalities for developers, enabling them to build robust applications. However, they are vulnerable to a specific issue that affects how URLs are parsed, potentially leading to security risks.
Vulnerability Detail
The vulnerability arises from improper validation of bracketed hosts in the urllib.parse.urlsplit() and urlparse() functions. This flaw allows hosts that are neither IPv6 nor IPvFuture to be processed incorrectly, which can lead to Server-Side Request Forgery (SSRF) attacks if a URL is handled by multiple URL parsers. The issue does not conform to RFC 3986 standards, making it a significant security concern.
How To Fix
Minimum fixed version
2.7.6-8ubuntu0.6+esm28
This is the first release that contains the fix.
sudo apt-get install --only-upgrade python2.7Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, avoid using URLs with bracketed hosts until the packages are updated. This can help mitigate the risk of SSRF attacks while waiting for a permanent fix.
Conclusion
In summary, CVE-2024-11168 presents a significant vulnerability in several Python packages due to improper URL host validation. It is crucial to update the affected packages to their patched versions to mitigate the risk of SSRF attacks. Users should also consider using workarounds until updates can be applied.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2024-11168 is a vulnerability in Python packages that allows improper validation of bracketed hosts in URL parsing functions, potentially leading to SSRF attacks.
The affected packages include python2.7, python3.4, python3.5, python3.6, python3.7, python3.8, python3.9, and python3.10.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 3.7, indicating a medium severity level.
If immediate updates are not possible, consider implementing the suggested workaround by avoiding the use of URLs with bracketed hosts.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
