gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format#103849

JohnJamesUtley · 2023-04-25T19:45:47Z

Addresses #103848

Issue: [CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets #103848

ghost · 2023-04-25T19:46:14Z

All commit authors signed the Contributor License Agreement.

bedevere-bot · 2023-04-26T13:28:42Z

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

…Pv6 or IPvFuture format

Lib/urllib/parse.py

Lib/test/test_urlparse.py

Lib/urllib/parse.py

bedevere-bot · 2023-05-09T15:48:39Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

…kets, adds comments, and a new test

JohnJamesUtley · 2023-05-09T20:31:54Z

I have made the requested changes; please review again

You're correct that .rpartition(']') was unnecessary here so I changed it back to the original .partition(']'). I originally changed it because it seemed cleaner to me but it isn't necessary to fix this issue.

bedevere-bot · 2023-05-09T20:31:58Z

Thanks for making the requested changes!

@gpshead: please review the changes made to this pull request.

miss-islington · 2023-05-10T00:18:38Z

Thanks @JohnJamesUtley for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349) pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format --------- (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]>

…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349) pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses. (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]> Co-authored-by: Lumír Balhar <[email protected]>

pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses. (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]> Co-authored-by: Lumír Balhar <[email protected]>

…urlsplit are of IPv6 or IPvFuture format (python#103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format --------- Co-authored-by: Gregory P. Smith <[email protected]> (cherry picked from commit 29f348e)

bedevere-app · 2024-11-18T15:34:51Z

GH-126975 is a backport of this pull request to the 3.10 branch.

…urlsplit are of IPv6 or IPvFuture format (python#103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format --------- Co-authored-by: Gregory P. Smith <[email protected]> (cherry picked from commit 29f348e)

bedevere-app · 2024-11-18T15:36:15Z

GH-126976 is a backport of this pull request to the 3.9 branch.

BitterDone · 2024-11-20T21:38:29Z

Hi @miss-islington and @gpshead - how do I ensure I'm using a version of Python with this vulnerability fixed?

I'm supporting a team that uses hardened containers from Iron Bank and I don't believe the approved containers will get the back port updates.

Since 3.11 is the newest version mentioned here for a back port, does the initial release of 3.12 include this fix?

CharlieZhao95 · 2024-11-29T01:35:43Z

Since 3.11 is the newest version mentioned here for a back port, does the initial release of 3.12 include this fix?

The release date of Pyton3.12 is 2023-10, so of course, 3.12 contains this patch. BTW miss-islington is a bot for PR. 😉

…urlsplit are of IPv6 or IPvFuture format (#103849) (#126976) Co-authored-by: Gregory P. Smith <[email protected]> (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]>

… urlsplit are of IPv6 or IPvFuture format (#103849) (#126975) Co-authored-by: Gregory P. Smith <[email protected]> (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]>

…ly validate IPv6 and IPvFuture addresses. Refs Python CVE-2024-11168. Django should not affected, but others who incorrectly use internal function _urlsplit() with unsanitized input could be at risk. python/cpython#103849

…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349) pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format --------- (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]>

pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses. (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]> Co-authored-by: Lumír Balhar <[email protected]>

JohnJamesUtley force-pushed the fix-issue-using-ipmodule branch from f840480 to df34308Compare April 25, 2023 20:02

arhadthedev added awaiting review stdlib Standard Library Python modules in the Lib/ directory labels Apr 26, 2023

bedevere-bot mentioned this pull request Apr 26, 2023
[CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets #103848
Closed

Adds checks to ensure that bracketed hosts found by urlsplit are of I…
37bc08c
…Pv6 or IPvFuture format

JohnJamesUtley force-pushed the fix-issue-using-ipmodule branch from f33126b to 37bc08cCompare April 26, 2023 13:59

gpshead self-assigned this May 9, 2023

ReSTify NEWS.
4057d35

gpshead requested changes May 9, 2023
View reviewed changes

Lib/urllib/parse.py Outdated Show resolvedHide resolved
Lib/urllib/parse.pyShow resolvedHide resolved
Lib/test/test_urlparse.py Outdated Show resolvedHide resolved
Lib/urllib/parse.pyShow resolvedHide resolved

bedevere-bot added awaiting changes and removed awaiting review labels May 9, 2023

Splits bracketed host tests in two, replaces rpartition for host brac…
20335ce
…kets, adds comments, and a new test

bedevere-bot added awaiting change review and removed awaiting changes labels May 9, 2023

bedevere-bot requested a review from gpshead May 9, 2023 20:32

gpshead approved these changes May 9, 2023
View reviewed changes

bedevere-bot added awaiting merge and removed awaiting change review labels May 9, 2023

gpshead added type-bug An unexpected behavior, bug, or error needs backport to 3.11 only security fixes labels May 9, 2023

remove trailing spaces
1783d43

gpshead enabled auto-merge (squash) May 9, 2023 23:54

gpshead merged commit 29f348e into python:mainMay 10, 2023

bedevere-bot removed the awaiting merge label May 10, 2023

frenzymadness mentioned this pull request Nov 14, 2024
00444: gh-103848: Adds checks to ensure that bracketed hosts found by… fedora-python/cpython#90
Merged

This was referenced Nov 15, 2024
python3: Address CVE-2024-11168 microsoft/azurelinux#11099
Merged
python3: Address CVE-2024-11168 with a formatted patch microsoft/azurelinux#11110
Merged

felixxm mentioned this pull request Dec 1, 2024
[4.2.x] Refs CVE-2024-11168 -- Updated vendored _urlsplit() to properly validate IPv6 and IPvFuture addresses. django/django#18872
Merged

sajjaphani mentioned this pull request May 19, 2025
[Security] Vulnerability found in Security vulnerability BIT-python-2024-11168 in package python habitat-sh/foundational-packages#67
Closed

Uh oh!

gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format#103849

gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format #103849

Uh oh!

Conversation

JohnJamesUtley commented Apr 25, 2023• edited by bedevere-bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ghost commented Apr 25, 2023• edited by ghost Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

bedevere-bot commented Apr 26, 2023

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

bedevere-bot commented May 9, 2023

Uh oh!

JohnJamesUtley commented May 9, 2023

Uh oh!

bedevere-bot commented May 9, 2023

Uh oh!

miss-islington commented May 10, 2023

Uh oh!

bedevere-appbot commented Nov 18, 2024

Uh oh!

bedevere-appbot commented Nov 18, 2024

Uh oh!

BitterDone commented Nov 20, 2024

Uh oh!

CharlieZhao95 commented Nov 29, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

8 participants

JohnJamesUtley commented Apr 25, 2023•
edited by bedevere-bot
Loading

ghost commented Apr 25, 2023•
edited by ghost
Loading