7.5
CVSSv3

CVE-2023-24329

Published: 17/02/2023 Updated: 07/11/2023
CVSS v3 Base Score: 7.5 | Impact Score: 3.6 | Exploitability Score: 3.9
VMScore: 0

Vulnerability Summary

An issue in the urllib.parse component of Python prior to 3.11.4 allows malicious users to bypass blocklisting methods by supplying a URL that starts with blank characters.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

python python

fedoraproject fedora 36

fedoraproject fedora 37

fedoraproject fedora 38

netapp ontap select deploy administration utility -

netapp active iq unified manager -

netapp management services for element software -

netapp management services for netapp hci -

Vendor Advisories

An issue was discovered in Python before 3111 An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service Hostnames are often supplied by remote servers that could be controlled b ...
An issue was discovered in Python before 3111 An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service Hostnames are often supplied by remote servers that could be controlled b ...
Description<!---->A flaw was found in the Python package An issue in the urllibparse component could allow attackers to bypass blocklisting methods by supplying a URL that starts with blank charactersThis may lead to compromised IntegrityA flaw was found in the Python package An issue in the urllibparse component could allow attackers to bypa ...
An issue in the urllibparse component of Python before v311 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters (CVE-2023-24329) ...
An issue was discovered in Python before 3111 An unnecessary quadratic algorithm exists in one path when processing some inputs to the IDNA (RFC 3490) decoder, such that a crafted, unreasonably long name being presented to the decoder could lead to a CPU denial of service Hostnames are often supplied by remote servers that could be controlled b ...
An issue in the urllibparse component of Python before v311 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters (CVE-2023-24329) ...
Synopsis Moderate: OpenShift Container Platform 4136 security and extras update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4136 is now available with updates to packages and images that fix several bugsThis release includes a security update for Red Hat OpenShift Container Platform 413R ...
概述 Important: python27:27 security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析 识别并修复受此公告影响的系统。 查看受影响的系统 标题 An update for the python27:27 module is now available for Red Hat Enterprise Linux 84 Advanced Mission Critical Update Support, Red ...
Synopsis Important: Red Hat Single Sign-On 764 for OpenShift image security enhancement update Type/Severity Security Advisory: Important Topic A new image is available for Red Hat Single Sign-On 764, running on OpenShift Container Platform 310 and 311, and 4120Red Hat Product Security has rated this update as having a security impac ...
Synopsis Important: python security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python is now available for Red Hat Enterprise Linux 6 Extended Lifecycle SupportRed Hat Product Security has rated ...
Synopsis Important: python39:39 and python39-devel:39 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the python39:39 and python39-devel:39 modules is now available for Red Hat Enterprise ...
Synopsis Moderate: Migration Toolkit for Containers (MTC) 1711 security and bug fix update Type/Severity Security Advisory: Moderate Topic The Migration Toolkit for Containers (MTC) 1711 is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) bas ...
Synopsis Moderate: OpenShift Container Platform 4136 bug fix and security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4136 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Con ...
Synopsis Important: python27:27 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the python27:27 module is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated thi ...
Synopsis Important: python38:38 and python38-devel:38 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the python38:38 and python38-devel:38 modules is now available for Red Hat Enterprise ...
Synopsis Moderate: Red Hat OpenShift Service Mesh Containers for 241 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Service Mesh 241 ContainersRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a det ...
Synopsis Moderate: Red Hat OpenShift Service Mesh Containers for 235 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Service Mesh 235 ContainersRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a det ...
Synopsis Moderate: Red Hat OpenShift Service Mesh 228 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Service Mesh 228Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is ...
Synopsis Important: python311 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python311 is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as hav ...
Synopsis Moderate: Logging Subsystem 573 - Red Hat OpenShift security update Type/Severity Security Advisory: Moderate Topic An update is now available for Red Hat OpenShift Logging Subsystem 573 Red Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, ...
Synopsis Important: python3 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python3 is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a ...
Synopsis Important: python security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a se ...
Synopsis Moderate: OpenShift Container Platform 4134 bug fix and security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4134 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Con ...
Synopsis Moderate: OpenShift Container Platform 41146 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 41146 is now available withupdates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Plat ...
Synopsis Important: OpenShift Virtualization 4125 security and bug fix update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Virtualization release 4125 is now available with updates to packages and images that fix several bugs and add enhancementsRed Hat Product Security has rated this update as having a security imp ...
概述 Important: python38:38 and python38-devel:38 security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析 识别并修复受此公告影响的系统。 查看受影响的系统 标题 An update for the python38:38 and python38-devel:38 modules is now available for Red Hat Enterprise Linux 8 ...
Synopsis Important: python39:39 and python39-devel:39 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the python39:39 and python39-devel:39 modules is now available for Red Hat Enterprise ...
概述 Important: python27:27 security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析 识别并修复受此公告影响的系统。 查看受影响的系统 标题 An update for the python27:27 module is now available for Red Hat Enterprise Linux 82 Advanced Update Support, Red Hat Enterprise L ...
Synopsis Moderate: Red Hat OpenShift Enterprise security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 41223 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Platform 4 ...
Synopsis Important: Service Telemetry Framework 152 security update Type/Severity Security Advisory: Important Topic An update is now available for Service Telemetry Framework 152Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring System (CVSS) base score, which gives a ...
Synopsis Important: Self Node Remediation Operator 051 security update Type/Severity Security Advisory: Important Topic This is an updated version of the Self Node Remediation Operator This Operator is delivered by Red Hat Workload AvailabilityRed Hat Product Security has rated this update as having a security impact of Important A Commo ...
Synopsis Important: python27:27 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the python27:27 module is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Prod ...
Synopsis Moderate: VolSync 073 security fixes and enhancements Type/Severity Security Advisory: Moderate Topic VolSync v073 enhancements and security fixesRed Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base score,which gives a detailed severity rating, is ...
Synopsis Important: python39 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python39 is now available for Red Hat Enterprise Linux 90 Extended Update SupportRed Hat Product Security has ...
Synopsis Important: python3 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python3 is now available for Red Hat Enterprise Linux 86 Extended Update SupportRed Hat Product Security has rate ...
Synopsis Important: python38:38 and python38-devel:38 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the python38:38 and python38-devel:38 modules is now available for Red Hat Enterprise ...
Synopsis Important: python38:38 and python38-devel:38 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the python38:38 and python38-devel:38 modules is now available for Red Hat Enterprise ...
Synopsis Important: python3 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python3 is now available for Red Hat Enterprise Linux 82 Advanced Update Support, Red Hat Enterprise Linux 82 Tel ...
Synopsis Moderate: Red Hat OpenShift Data Foundation 4119 security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4119 on Red Hat Enterprise Linux 8 from Red Hat Container RegistryRed Hat Product Security has rated this update ...
Synopsis Critical: Red Hat Advanced Cluster Management 267 security and bug fix updates Type/Severity Security Advisory: Critical Topic Red Hat Advanced Cluster Management for Kubernetes 267 GeneralAvailability release images, which provide security updates and fix bugsRed Hat Product Security has rated this update as having a security i ...
Synopsis Important: python39 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python39 is now available for Red Hat Enterprise Linux 9Red Hat Product Security has rated this update as havin ...
Synopsis Important: python311 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for python311 is now available for Red Hat Enterprise Linux 8Red Hat Product Security has rated this update as hav ...
Synopsis Important: python39:39 and python39-devel:39 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the python39:39 and python39-devel:39 modules is now available for Red Hat Enterprise ...
Synopsis Moderate: OpenShift Container Platform 4135 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4135 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Platf ...
Synopsis Moderate: OpenShift Container Platform 4135 security update Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Container Platform release 4135 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift Container Platf ...
Synopsis Moderate: Red Hat OpenShift Data Foundation 41014 security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 41014 on Red Hat Enterprise Linux 8 from Red Hat Container RegistryRed Hat Product Security has rated this upda ...
Synopsis Critical: Multicluster Engine for Kubernetes 218 security updates and bug fixes Type/Severity Security Advisory: Critical Topic Multicluster Engine for Kubernetes 218 General Availability release images, which fix bugs and update container imagesRed Hat Product Security has rated this update as having a security impactof Critica ...
概述 Moderate: Red Hat OpenShift Data Foundation 4125 security and bug fix update 类型/严重性 Security Advisory: Moderate 标题 Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4125 on Red Hat Enterprise Linux 8 from Red Hat Container RegistryRed Hat Product Security has rated this upda ...
Synopsis Moderate: Red Hat OpenShift Data Foundation 4131 security and bug fix update Type/Severity Security Advisory: Moderate Topic Updated images that fix several bugs are now available for Red Hat OpenShift Data Foundation 4131 on Red Hat Enterprise Linux 8 from Red Hat Container RegistryRed Hat Product Security has rated this update ...
概述 Important: python3 security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析 识别并修复受此公告影响的系统。 查看受影响的系统 标题 An update for python3 is now available for Red Hat Enterprise Linux 81 Update Services for SAP SolutionsRed Hat Product Security has rat ...
概述 Important: python3 security update 类型/严重性 Security Advisory: Important Red Hat Insights 补丁分析 识别并修复受此公告影响的系统。 查看受影响的系统 标题 An update for python3 is now available for Red Hat Enterprise Linux 84 Advanced Mission Critical Update Support, Red Hat Enterprise Linux ...
Synopsis Important: OpenShift Container Platform 41144 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41144 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
Synopsis Important: python27:27 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for the python27:27 module is now available for Red Hat Enterprise Linux 81 Update Services for SAP SolutionsRe ...
Synopsis Important: Red Hat Virtualization Host 44z SP 1 security update Type/Severity Security Advisory: Important Red Hat Insights patch analysis Identify and remediate systems affected by this advisory View affected systems Topic An update for redhat-release-virtualization-host and redhat-virtualization-host is now available f ...
Synopsis Important: python3 security update Type / Sévérité Security Advisory: Important Analyse des correctifs dans Red Hat Insights Identifiez et remédiez aux systèmes concernés par cette alerte Voir les systèmes concernés Sujet An update for python3 is now available for Red Hat Enterprise Linux 8Red Hat Product Security ...
Synopsis Moderate: VolSync 063 security fixes and enhancements Type/Severity Security Advisory: Moderate Topic VolSync v063 security fixes and enhancementsRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, ...
Synopsis Moderate: Release of OpenShift Serverless 1291 Type/Severity Security Advisory: Moderate Topic Red Hat OpenShift Serverless version 1291 is now availableRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity ...
Synopsis Moderate: ACS 41 enhancement and security update Type/Severity Security Advisory: Moderate Topic Updated images are now available for Red Hat Advanced Cluster Security (RHACS) The updated image includes new features and bug fixesRed Hat Product Security has rated this update as having a security impact of Moderate A Common Vulner ...
Synopsis Moderate: OpenShift sandboxed containers 141 security update Type/Severity Security Advisory: Moderate Topic OpenShift sandboxed containers 141 is now availableRed Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring System (CVSS) base score, whichgives a detailed seve ...
Synopsis Moderate: OpenShift Jenkins image and Jenkins agent base image security update Type/Severity Security Advisory: Moderate Topic Release of Bug Advisories for the OpenShift Jenkins image and Jenkins agent base imageRed Hat Product Security has rated this update as having a security impactof Moderate A Common Vulnerability Scoring Sys ...
Synopsis Important: OpenShift Container Platform 41145 bug fix and security update Type/Severity Security Advisory: Important Topic Red Hat OpenShift Container Platform release 41145 is now available with updates to packages and images that fix several bugs and add enhancementsThis release includes a security update for Red Hat OpenShift ...
Synopsis Important: Red Hat OpenShift Data Foundation 4130 security and bug fix update Type/Severity Security Advisory: Important Topic Updated images that include numerous enhancements, security, and bug fixes are now available in Red Hat Container Registry for Red Hat OpenShift Data Foundation 4130 on Red Hat Enterprise Linux 9Red Hat ...

Github Repositories

CVE-2023-24329-PoC A short and inforamtional PoC on CVE-2023-24329: Python urllib parsing flaw git clone githubcom/H4R335HR/CVE-2023-24329-PoC cd CVE-2023-24329-PoC python3 CVE-2023-24329-PoCpy Based on research by Yebo Cao - pointernullcom/security/python-url-parse-problemhtml

References

CWE-20https://pointernull.com/security/python-url-parse-problem.htmlhttps://github.com/python/cpython/pull/99421https://security.netapp.com/advisory/ntap-20230324-0004/https://github.com/python/cpython/issues/102153https://www.kb.cert.org/vuls/id/127587https://lists.debian.org/debian-lts-announce/2023/09/msg00022.htmlhttps://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/https://nvd.nist.govhttps://github.com/H4R335HR/CVE-2023-24329-PoChttps://alas.aws.amazon.com/ALAS-2023-1713.htmlhttps://www.cisa.gov/news-events/ics-advisories/icsa-23-348-10