GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — Backport CVE-2023-24329 to all in-service releases: urlparse does not correctly handle schemes that begin with ASCII digits, '+', '-', and '.' characters · Issue #102293 · python/cpython

Backport CVE-2023-24329 to all in-service releases: urlparse does not correctly handle schemes that begin with ASCII digits, '+', '-', and '.' characters  #102293

New issue
Copy link
New issue
Copy link
Closed as not planned
Closed as not planned
Backport CVE-2023-24329 to all in-service releases: urlparse does not correctly handle schemes that begin with ASCII digits, '+', '-', and '.' characters #102293
Copy link
Labels
type-featureA feature request or enhancementA feature request or enhancementtype-securityA security issueA security issue

Description

@RSAlderman
RSAlderman
opened on Feb 27, 2023
Issue body actions

Feature or enhancement

Backport CVE-2023-24329 (CVSS 7.5: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) to all in-service releases: urlparse does not correctly handle schemes that begin with ASCII digits, '+', '-', and '.' characters which was backported to 3.11.1 only

Pitch

This is a security vulnerability that has only been backported to 3.11.1, not the other releases (3.7-3.10) that are currently supported.

Previous discussion

Is it possible to get an idea of a timescale for such as backport to be implemented in the earlier supported releases?

Activity

  1. RSAlderman
    added
    type-featureA feature request or enhancementA feature request or enhancement
    on Feb 27, 2023
  2. AlexWaygood
    added
    type-securityA security issueA security issue
    on Feb 27, 2023

  3. gpshead commented on Feb 27, 2023

    @gpshead
    gpshead
    on Feb 27, 2023
    Member
    More actions

    I'm closing this as a duplicate of #102153 as it isn't clear that all of this was even fixed. We'll make any decision on what to backport it to there.

  4. gpshead
    closed this as completedon Feb 27, 2023
  5. gpshead
    closed this as not plannedon Apr 27, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    type-featureA feature request or enhancementA feature request or enhancementtype-securityA security issueA security issue

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions
      You are visitor 01402503 — GeezerVison does not store the pages you look up.
      Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.