GV

GeezerVison

The World Wide Web, restored to 800 pixels of glory.

Home|About|Gaming cabinet|Archives|How it works|Starter sites

On this site

  • Sign in
  • ActionsCI/CD and automation
  • CodespacesCloud development environments
  • All Features
  • Documentation
  • Training
  • Certifications
  • Build with Copilot
  • Customize Copilot
  • Integrations
  • Trending repos
  • GitHub Sponsors
  • Developer articles
  • Enterprises

This view

  • Original page
  • New address

GeezerVison is showing github.com — [3.9] gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (#103849) by vstinner · Pull Request #126976 · python/cpython

Conversation

@vstinner

@vstinner vstinner commented Nov 18, 2024 •
edited by bedevere-app Bot
Loading

Uh oh!

There was an error while loading. Please reload this page.

Copy link
Copy Markdown
Member
  • Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format

Co-authored-by: Gregory P. Smith [email protected]
(cherry picked from commit 29f348e)

  • Issue: [CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets #103848

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
All reactions
@JohnJamesUtley @gpshead @vstinner
pythongh-103848: Adds checks to ensure that bracketed hosts found by …
a246131 
…urlsplit are of IPv6 or IPvFuture format (python#103849)

* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format

---------

Co-authored-by: Gregory P. Smith <[email protected]>
(cherry picked from commit 29f348e)
@bedevere-app bedevere-app Bot added the type-bug An unexpected behavior, bug, or error label Nov 18, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Nov 18, 2024
gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format #103849
Merged
@bedevere-app bedevere-app Bot added the awaiting core review label Nov 18, 2024
@bedevere-app bedevere-app Bot mentioned this pull request Nov 18, 2024
[CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets #103848
Closed
@vstinner

vstinner commented Nov 19, 2024

Copy link
Copy Markdown
Member Author

@gpshead: Would you mind to proof-read this backport PR to 3.9? I had a minor conflict Lib/urllib/parse.py because urlsplit() has a decorator on Python 3.11 and newer.
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
gpshead
gpshead approved these changes Nov 19, 2024
View reviewed changes
@bedevere-app bedevere-app Bot added awaiting merge and removed awaiting core review labels Nov 19, 2024
@vstinner

vstinner commented Nov 20, 2024

Copy link
Copy Markdown
Member Author

@pablogsal, @ambv: Would you mind to review/merge this security fix?
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@vstinner

vstinner commented Nov 28, 2024

Copy link
Copy Markdown
Member Author

@pablogsal, @ambv: Gentle reminder. Would you mind to review/merge this security fix? It would be nice to get this fix in the next batch of security releases (December 3rd).
All reactions

Sorry, something went wrong.

Uh oh!

There was an error while loading. Please reload this page.
@ambv
ambv merged commit ddca295 into python:3.9 Dec 2, 2024
@bedevere-app bedevere-app Bot removed the awaiting merge label Dec 2, 2024
@vstinner
vstinner deleted the urlsplit9 branch December 2, 2024 12:44
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

Uh oh!

There was an error while loading. Please reload this page.

Assignees

No one assigned

Labels

type-bug An unexpected behavior, bug, or error

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Uh oh!

There was an error while loading. Please reload this page.

4 participants

@vstinner @gpshead @ambv @JohnJamesUtley
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
You are visitor 01402503 — GeezerVison does not store the pages you look up.
Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required.