gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format #103849

JohnJamesUtley · 2023-04-25T19:45:47Z

Addresses #103848

Issue: [CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets #103848

cpython-cla-bot · 2023-04-25T19:46:14Z

All commit authors signed the Contributor License Agreement.

bedevere-bot · 2023-04-26T13:28:42Z

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

…Pv6 or IPvFuture format

Lib/urllib/parse.py

Lib/test/test_urlparse.py

Lib/urllib/parse.py

bedevere-bot · 2023-05-09T15:48:39Z

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

…kets, adds comments, and a new test

JohnJamesUtley · 2023-05-09T20:31:54Z

I have made the requested changes; please review again

You're correct that .rpartition(']') was unnecessary here so I changed it back to the original .partition(']'). I originally changed it because it seemed cleaner to me but it isn't necessary to fix this issue.

bedevere-bot · 2023-05-09T20:31:58Z

Thanks for making the requested changes!

@gpshead: please review the changes made to this pull request.

miss-islington · 2023-05-10T00:18:38Z

Thanks @JohnJamesUtley for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

bedevere-bot · 2023-05-10T06:10:55Z

GH-104349 is a backport of this pull request to the 3.11 branch.

…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format --------- Co-authored-by: Gregory P. Smith <[email protected]> (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]>

… urlsplit are of IPv6 or IPvFuture format (GH-103849) (#104349) gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (GH-103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format --------- (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]>

* main: pythonGH-102181: Improve specialization stats for SEND (pythonGH-102182) pythongh-103000: Optimise `dataclasses.asdict` for the common case (python#104364) pythongh-103538: Remove unused TK_AQUA code (pythonGH-103539) pythonGH-87695: Fix OSError from `pathlib.Path.glob()` (pythonGH-104292) pythongh-104263: Rely on Py_NAN and introduce Py_INFINITY (pythonGH-104202) pythongh-104010: Separate and improve docs for `typing.get_origin` and `typing.get_args` (python#104013) pythongh-101819: Adapt _io._BufferedIOBase_Type methods to Argument Clinic (python#104355) pythongh-103960: Dark mode: invert image brightness (python#103983) pythongh-104252: Immortalize Py_EMPTY_KEYS (pythongh-104253) pythongh-101819: Clean up _io windows console io after pythongh-104197 (python#104354) pythongh-101819: Harden _io init (python#104352) pythongh-103247: clear the module cache in a test in test_importlib/extensions/test_loader.py (pythonGH-104226) pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (python#103849) pythongh-74895: adjust tests to work on Solaris (python#104326) pythongh-101819: Refactor _io in preparation for module isolation (python#104334) pythongh-90953: Don't use deprecated AST nodes in clinic.py (python#104322) pythongh-102327: Extend docs for "url" and "headers" parameters to HTTPConnection.request() pythongh-104328: Fix typo in ``typing.Generic`` multiple inheritance error message (python#104335)

…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349) pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format --------- (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]>

…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349) pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses. (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]> Co-authored-by: Lumír Balhar <[email protected]>

pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses. (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]> Co-authored-by: Gregory P. Smith <[email protected]> Co-authored-by: Lumír Balhar <[email protected]>

…urlsplit are of IPv6 or IPvFuture format (python#103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format --------- Co-authored-by: Gregory P. Smith <[email protected]> (cherry picked from commit 29f348e)

bedevere-app · 2024-11-18T15:34:51Z

GH-126975 is a backport of this pull request to the 3.10 branch.

…urlsplit are of IPv6 or IPvFuture format (python#103849) * Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format --------- Co-authored-by: Gregory P. Smith <[email protected]> (cherry picked from commit 29f348e)

bedevere-app · 2024-11-18T15:36:15Z

GH-126976 is a backport of this pull request to the 3.9 branch.

BitterDone · 2024-11-20T21:38:29Z

Hi @miss-islington and @gpshead - how do I ensure I'm using a version of Python with this vulnerability fixed?

I'm supporting a team that uses hardened containers from Iron Bank and I don't believe the approved containers will get the back port updates.

Since 3.11 is the newest version mentioned here for a back port, does the initial release of 3.12 include this fix?

CharlieZhao95 · 2024-11-29T01:35:43Z

Since 3.11 is the newest version mentioned here for a back port, does the initial release of 3.12 include this fix?

The release date of Pyton3.12 is 2023-10, so of course, 3.12 contains this patch. BTW miss-islington is a bot for PR. 😉

…vFuture addresses. Refs Python CVE-2024-11168. Django should not affected, but others who incorrectly use internal function url_has_allowed_host_and_scheme() with unsanitized input could be at risk. python/cpython#103849

…ly validate IPv6 and IPvFuture addresses. Refs Python CVE-2024-11168. Django should not affected, but others who incorrectly use internal function url_has_allowed_host_and_scheme() with unsanitized input could be at risk. python/cpython#103849

…ly validate IPv6 and IPvFuture addresses. Refs Python CVE-2024-11168. Django should not affected, but others who incorrectly use internal function _urlsplit() with unsanitized input could be at risk. python/cpython#103849

…urlsplit are of IPv6 or IPvFuture format (#103849) (#126976) Co-authored-by: Gregory P. Smith <[email protected]> (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]>

… urlsplit are of IPv6 or IPvFuture format (#103849) (#126975) Co-authored-by: Gregory P. Smith <[email protected]> (cherry picked from commit 29f348e) Co-authored-by: JohnJamesUtley <[email protected]>

…ly validate IPv6 and IPvFuture addresses. Refs Python CVE-2024-11168. Django should not affected, but others who incorrectly use internal function _urlsplit() with unsanitized input could be at risk. python/cpython#103849

JohnJamesUtley force-pushed the fix-issue-using-ipmodule branch from f840480 to df34308 Compare April 25, 2023 20:02

arhadthedev added awaiting review stdlib Python modules in the Lib dir labels Apr 26, 2023

bedevere-bot mentioned this pull request Apr 26, 2023

[CVE-2024-11168] urlparse incorrectly retrieves IPv4 and regular name hosts from inside of brackets #103848

Closed

Adds checks to ensure that bracketed hosts found by urlsplit are of I…

37bc08c

…Pv6 or IPvFuture format

JohnJamesUtley force-pushed the fix-issue-using-ipmodule branch from f33126b to 37bc08c Compare April 26, 2023 13:59

gpshead self-assigned this May 9, 2023

ReSTify NEWS.

4057d35

gpshead requested changes May 9, 2023

View reviewed changes

Lib/urllib/parse.py Outdated Show resolved Hide resolved

Lib/urllib/parse.py Show resolved Hide resolved

Lib/test/test_urlparse.py Outdated Show resolved Hide resolved

Lib/urllib/parse.py Show resolved Hide resolved

bedevere-bot added awaiting changes and removed awaiting review labels May 9, 2023

Splits bracketed host tests in two, replaces rpartition for host brac…

20335ce

…kets, adds comments, and a new test

bedevere-bot added awaiting change review and removed awaiting changes labels May 9, 2023

bedevere-bot requested a review from gpshead May 9, 2023 20:32

gpshead approved these changes May 9, 2023

View reviewed changes

bedevere-bot added awaiting merge and removed awaiting change review labels May 9, 2023

gpshead added type-bug An unexpected behavior, bug, or error needs backport to 3.11 only security fixes labels May 9, 2023

remove trailing spaces

1783d43

gpshead enabled auto-merge (squash) May 9, 2023 23:54

gpshead merged commit 29f348e into python:main May 10, 2023

bedevere-bot removed the awaiting merge label May 10, 2023

bedevere-bot removed the needs backport to 3.11 only security fixes label May 10, 2023

henryborchers mentioned this pull request Jun 12, 2023

devpi test not working on Python 3.11.4 devpi/devpi#978

Closed

frenzymadness mentioned this pull request Nov 14, 2024

00444: gh-103848: Adds checks to ensure that bracketed hosts found by… fedora-python/cpython#90

Merged

This was referenced Nov 15, 2024

python3: Address CVE-2024-11168 microsoft/azurelinux#11099

Merged

python3: Address CVE-2024-11168 with a formatted patch microsoft/azurelinux#11110

Merged

felixxm mentioned this pull request Dec 1, 2024

[4.2.x] Refs CVE-2024-11168 -- Updated vendored _urlsplit() to properly validate IPv6 and IPvFuture addresses. django/django#18872

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format #103849

gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format #103849

JohnJamesUtley commented Apr 25, 2023 •

edited by bedevere-bot

Loading

cpython-cla-bot bot commented Apr 25, 2023 •

edited

Loading

bedevere-bot commented Apr 26, 2023

bedevere-bot commented May 9, 2023

JohnJamesUtley commented May 9, 2023

bedevere-bot commented May 9, 2023

miss-islington commented May 10, 2023

bedevere-bot commented May 10, 2023

bedevere-app bot commented Nov 18, 2024

bedevere-app bot commented Nov 18, 2024

BitterDone commented Nov 20, 2024

CharlieZhao95 commented Nov 29, 2024

gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format #103849

gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format #103849

Conversation

JohnJamesUtley commented Apr 25, 2023 • edited by bedevere-bot Loading

cpython-cla-bot bot commented Apr 25, 2023 • edited Loading

bedevere-bot commented Apr 26, 2023

bedevere-bot commented May 9, 2023

JohnJamesUtley commented May 9, 2023

bedevere-bot commented May 9, 2023

miss-islington commented May 10, 2023

bedevere-bot commented May 10, 2023

bedevere-app bot commented Nov 18, 2024

bedevere-app bot commented Nov 18, 2024

BitterDone commented Nov 20, 2024

CharlieZhao95 commented Nov 29, 2024

JohnJamesUtley commented Apr 25, 2023 •

edited by bedevere-bot

Loading

cpython-cla-bot bot commented Apr 25, 2023 •

edited

Loading