GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format by JohnJamesUtley · Pull Request #103849 · python/cpython

Conversation

@JohnJamesUtley

@JohnJamesUtley JohnJamesUtley commented Apr 25, 2023 •
edited by bedevere-bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Contributor

Addresses #103848

  • Issue: [CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets #103848

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@ghost

ghost commented Apr 25, 2023 •
edited by ghost
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown

All commit authors signed the Contributor License Agreement.
CLA signed
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@JohnJamesUtley
JohnJamesUtley force-pushed the fix-issue-using-ipmodule branch from f840480 to df34308 Compare April 25, 2023 20:02
@arhadthedev arhadthedev added awaiting review stdlib Standard Library Python modules in the Lib/ directory labels Apr 26, 2023
@bedevere-bot bedevere-bot mentioned this pull request Apr 26, 2023
[CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets #103848
Closed
@bedevere-bot

bedevere-bot commented Apr 26, 2023

Copy link
Copy Markdown

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@JamesJohnUtley
Adds checks to ensure that bracketed hosts found by urlsplit are of I…
37bc08c 
…Pv6 or IPvFuture format
@JohnJamesUtley
JohnJamesUtley force-pushed the fix-issue-using-ipmodule branch from f33126b to 37bc08c Compare April 26, 2023 13:59
@gpshead gpshead self-assigned this May 9, 2023
@gpshead
ReSTify NEWS.
4057d35
gpshead
gpshead requested changes May 9, 2023
View reviewed changes
Comment thread Lib/urllib/parse.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/urllib/parse.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/test/test_urlparse.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
Comment thread Lib/urllib/parse.py Resolved

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot added awaiting changes and removed awaiting review labels May 9, 2023
@bedevere-bot

bedevere-bot commented May 9, 2023

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@JamesJohnUtley
Splits bracketed host tests in two, replaces rpartition for host brac…
20335ce 
…kets, adds comments, and a new test
@JohnJamesUtley

JohnJamesUtley commented May 9, 2023

Copy link
Copy Markdown
Contributor Author

I have made the requested changes; please review again

You're correct that .rpartition(']') was unnecessary here so I changed it back to the original .partition(']'). I originally changed it because it seemed cleaner to me but it isn't necessary to fix this issue.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot added awaiting change review and removed awaiting changes labels May 9, 2023
@bedevere-bot

bedevere-bot commented May 9, 2023

Copy link
Copy Markdown

Thanks for making the requested changes!

@gpshead: please review the changes made to this pull request.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot
bedevere-bot requested a review from gpshead May 9, 2023 20:32
gpshead
gpshead approved these changes May 9, 2023
View reviewed changes
@bedevere-bot bedevere-bot added awaiting merge and removed awaiting change review labels May 9, 2023
@gpshead gpshead added type-bug An unexpected behavior, bug, or error needs backport to 3.11 only security fixes labels May 9, 2023
@gpshead
remove trailing spaces
1783d43
@gpshead
gpshead enabled auto-merge (squash) May 9, 2023 23:54
@gpshead
gpshead merged commit 29f348e into python:main May 10, 2023
@miss-islington

miss-islington commented May 10, 2023

Copy link
Copy Markdown
Contributor

Thanks @JohnJamesUtley for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@bedevere-bot bedevere-bot removed the awaiting merge label May 10, 2023
frenzymadness added a commit to frenzymadness/cpython that referenced this pull request Nov 14, 2024
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness
00444: Security fix for CVE-2024-11168
1717327 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Lumír Balhar <[email protected]>
frenzymadness added a commit to fedora-python/cpython that referenced this pull request Nov 14, 2024
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness
00444: Security fix for CVE-2024-11168
0aef6ad 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Lumír Balhar <[email protected]>
This was referenced Nov 15, 2024
python3: Address CVE-2024-11168 microsoft/azurelinux#11099
Merged
python3: Address CVE-2024-11168 with a formatted patch microsoft/azurelinux#11110
Merged
vstinner pushed a commit to vstinner/cpython that referenced this pull request Nov 18, 2024
@JohnJamesUtley @gpshead @vstinner
pythongh-103848: Adds checks to ensure that bracketed hosts found by …
ab6f221 
…urlsplit are of IPv6 or IPvFuture format (python#103849)

* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format

---------

Co-authored-by: Gregory P. Smith <[email protected]>
(cherry picked from commit 29f348e)
@bedevere-app

bedevere-app Bot commented Nov 18, 2024

Copy link
Copy Markdown

GH-126975 is a backport of this pull request to the 3.10 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
vstinner pushed a commit to vstinner/cpython that referenced this pull request Nov 18, 2024
@JohnJamesUtley @gpshead @vstinner
pythongh-103848: Adds checks to ensure that bracketed hosts found by …
a246131 
…urlsplit are of IPv6 or IPvFuture format (python#103849)

* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format

---------

Co-authored-by: Gregory P. Smith <[email protected]>
(cherry picked from commit 29f348e)
@bedevere-app

bedevere-app Bot commented Nov 18, 2024

Copy link
Copy Markdown

GH-126976 is a backport of this pull request to the 3.9 branch.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@BitterDone

BitterDone commented Nov 20, 2024

Copy link
Copy Markdown

Hi @miss-islington and @gpshead - how do I ensure I'm using a version of Python with this vulnerability fixed?

I'm supporting a team that uses hardened containers from Iron Bank and I don't believe the approved containers will get the back port updates.

Since 3.11 is the newest version mentioned here for a back port, does the initial release of 3.12 include this fix?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@CharlieZhao95

CharlieZhao95 commented Nov 29, 2024

Copy link
Copy Markdown
Contributor

Since 3.11 is the newest version mentioned here for a back port, does the initial release of 3.12 include this fix?

The release date of Pyton3.12 is 2023-10, so of course, 3.12 contains this patch. BTW miss-islington is a bot for PR. 😉
BitterDone reacted with heart emoji
All reactions
  • ❤️ 1 reaction

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@felixxm felixxm mentioned this pull request Dec 1, 2024
[4.2.x] Refs CVE-2024-11168 -- Updated vendored _urlsplit() to properly validate IPv6 and IPvFuture addresses. django/django#18872
Merged
ambv pushed a commit that referenced this pull request Dec 2, 2024
@vstinner @JohnJamesUtley
[3.9] gh-103848: Adds checks to ensure that bracketed hosts found by …
ddca295 
…urlsplit are of IPv6 or IPvFuture format (#103849) (#126976)

Co-authored-by: Gregory P. Smith <[email protected]>
(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <[email protected]>
ambv pushed a commit that referenced this pull request Dec 2, 2024
@vstinner @JohnJamesUtley
[3.10] gh-103848: Adds checks to ensure that bracketed hosts found by…
634ded4 
… urlsplit are of IPv6 or IPvFuture format (#103849) (#126975)

Co-authored-by: Gregory P. Smith <[email protected]>
(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <[email protected]>
sarahboyce pushed a commit to felixxm/django that referenced this pull request Dec 3, 2024
@felixxm @sarahboyce
[4.2.x] Refs CVE-2024-11168 -- Updated vendored _urlsplit() to proper…
18dcf92 
…ly validate IPv6 and IPvFuture addresses.

Refs Python CVE-2024-11168. Django should not affected, but others who
incorrectly use internal function _urlsplit() with unsanitized input
could be at risk.

python/cpython#103849
sarahboyce pushed a commit to django/django that referenced this pull request Dec 3, 2024
@felixxm @sarahboyce
[4.2.x] Refs CVE-2024-11168 -- Updated vendored _urlsplit() to proper…
f663277 
…ly validate IPv6 and IPvFuture addresses.

Refs Python CVE-2024-11168. Django should not affected, but others who
incorrectly use internal function _urlsplit() with unsanitized input
could be at risk.

python/cpython#103849
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Apr 9, 2025
@miss-islington @JohnJamesUtley
@gpshead @mgorny
[3.11] pythongh-103848: Adds checks to ensure that bracketed hosts fo…
28bc8e7 
…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349)

pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format

---------

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
hrnciar pushed a commit to fedora-python/cpython that referenced this pull request Apr 23, 2025
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness @hrnciar
00444: Security fix for CVE-2024-11168
38e5d6c 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Lumír Balhar <[email protected]>
@sajjaphani sajjaphani mentioned this pull request May 19, 2025
[Security] Vulnerability found in Security vulnerability BIT-python-2024-11168 in package python habitat-sh/foundational-packages#67
Closed
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Jul 4, 2025
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness @hroncok
00444: Security fix for CVE-2024-11168
e40bece 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Lumír Balhar <[email protected]>
frenzymadness added a commit to fedora-python/cpython that referenced this pull request Aug 12, 2025
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness
00444: Security fix for CVE-2024-11168
48dea74 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Lumír Balhar <[email protected]>
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Feb 3, 2026
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness @hroncok
00444: Security fix for CVE-2024-11168
0258af6 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <[email protected]>
Co-authored-by: Gregory P. Smith <[email protected]>
Co-authored-by: Lumír Balhar <[email protected]>
This was referenced Jul 17, 2026
feat: enforce engagement authorization framing SALhik/AutoPentester#15
Merged
feat: add cookie session authorization Deko-sudo/pepe#5
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

@gpshead gpshead

Labels

stdlib Standard Library Python modules in the Lib/ directory type-bug An unexpected behavior, bug, or error

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

8 participants

@JohnJamesUtley @bedevere-bot @miss-islington @BitterDone @CharlieZhao95 @gpshead @arhadthedev @JamesJohnUtley
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.