The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.
Platform | Package | Release Date | Advisory |
---|---|---|---|
Amazon Linux 2 - Core | python3 | 2025-02-12 23:17 | ALAS2-2025-2754 |
Amazon Linux 2023 | python3.11 | 2024-01-19 01:31 | ALAS2023-2024-500 |
Score Type | Score | Vector | |
---|---|---|---|
Amazon Linux | CVSSv3 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
NVD | CVSSv3 | 3.7 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |