◐ Shell
reader mode source ↗
Skip to content

gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format#103849

Merged
gpshead merged 4 commits into
python:mainfrom
JohnJamesUtley:fix-issue-using-ipmodule
May 10, 2023
Merged

gh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format#103849
gpshead merged 4 commits into
python:mainfrom
JohnJamesUtley:fix-issue-using-ipmodule

Conversation

@JohnJamesUtley

@JohnJamesUtley JohnJamesUtley commented Apr 25, 2023 •
edited by bedevere-bot
Loading

Copy link
Copy Markdown
Contributor

@ghost

ghost commented Apr 25, 2023 •
edited by ghost
Loading

Copy link
Copy Markdown

All commit authors signed the Contributor License Agreement.
CLA signed

@JohnJamesUtley JohnJamesUtley force-pushed the fix-issue-using-ipmodule branch from f840480 to df34308 Compare April 25, 2023 20:02
@arhadthedev arhadthedev added awaiting review stdlib Standard Library Python modules in the Lib/ directory labels Apr 26, 2023
@bedevere-bot bedevere-bot mentioned this pull request Apr 26, 2023
Closed
@bedevere-bot

bedevere-bot commented Apr 26, 2023

Copy link
Copy Markdown

Most changes to Python require a NEWS entry.

Please add it using the blurb_it web app or the blurb command-line tool.

@JohnJamesUtley JohnJamesUtley force-pushed the fix-issue-using-ipmodule branch from f33126b to 37bc08c Compare April 26, 2023 13:59
@gpshead gpshead self-assigned this May 9, 2023
@bedevere-bot

bedevere-bot commented May 9, 2023

Copy link
Copy Markdown

A Python core developer has requested some changes be made to your pull request before we can consider merging it. If you could please address their requests along with any other requests in other reviews from core developers that would be appreciated.

Once you have made the requested changes, please leave a comment on this pull request containing the phrase I have made the requested changes; please review again. I will then notify any core developers who have left a review that you're ready for them to take another look at this pull request.

@JohnJamesUtley

JohnJamesUtley commented May 9, 2023

Copy link
Copy Markdown
Contributor Author

I have made the requested changes; please review again

You're correct that .rpartition(']') was unnecessary here so I changed it back to the original .partition(']'). I originally changed it because it seemed cleaner to me but it isn't necessary to fix this issue.

@bedevere-bot

bedevere-bot commented May 9, 2023

Copy link
Copy Markdown

Thanks for making the requested changes!

@gpshead: please review the changes made to this pull request.

@bedevere-bot bedevere-bot requested a review from gpshead May 9, 2023 20:32
@gpshead gpshead enabled auto-merge (squash) May 9, 2023 23:54
@gpshead gpshead merged commit 29f348e into python:main May 10, 2023
@miss-islington

miss-islington commented May 10, 2023

Copy link
Copy Markdown
Contributor

Thanks @JohnJamesUtley for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.11.
🐍🍒⛏🤖

50 hidden items Load more…
frenzymadness added a commit to frenzymadness/cpython that referenced this pull request Nov 14, 2024
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness
00444: pythongh-103848: Adds checks to ensure that bracketed hosts fo… …
ca130e5 
…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349)

pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
@frenzymadness frenzymadness mentioned this pull request Nov 14, 2024
Merged
frenzymadness added a commit to frenzymadness/cpython that referenced this pull request Nov 14, 2024
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness
00444: Security fix for CVE-2024-11168 …
1717327 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
This was referenced Nov 15, 2024
Merged
Merged
vstinner pushed a commit to vstinner/cpython that referenced this pull request Nov 18, 2024
@JohnJamesUtley @gpshead @vstinner
pythongh-103848: Adds checks to ensure that bracketed hosts found by … …
ab6f221 
…urlsplit are of IPv6 or IPvFuture format (python#103849)

* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format

---------

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 29f348e)
@bedevere-app

bedevere-app Bot commented Nov 18, 2024

Copy link
Copy Markdown

GH-126975 is a backport of this pull request to the 3.10 branch.

vstinner pushed a commit to vstinner/cpython that referenced this pull request Nov 18, 2024
@JohnJamesUtley @gpshead @vstinner
pythongh-103848: Adds checks to ensure that bracketed hosts found by … …
a246131 
…urlsplit are of IPv6 or IPvFuture format (python#103849)

* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format

---------

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 29f348e)
@bedevere-app

bedevere-app Bot commented Nov 18, 2024

Copy link
Copy Markdown

GH-126976 is a backport of this pull request to the 3.9 branch.

@BitterDone

BitterDone commented Nov 20, 2024

Copy link
Copy Markdown

Hi @miss-islington and @gpshead - how do I ensure I'm using a version of Python with this vulnerability fixed?

I'm supporting a team that uses hardened containers from Iron Bank and I don't believe the approved containers will get the back port updates.

Since 3.11 is the newest version mentioned here for a back port, does the initial release of 3.12 include this fix?

@CharlieZhao95

CharlieZhao95 commented Nov 29, 2024

Copy link
Copy Markdown
Contributor

Since 3.11 is the newest version mentioned here for a back port, does the initial release of 3.12 include this fix?

The release date of Pyton3.12 is 2023-10, so of course, 3.12 contains this patch. BTW miss-islington is a bot for PR. 😉

@felixxm felixxm mentioned this pull request Dec 1, 2024
Merged
ambv pushed a commit that referenced this pull request Dec 2, 2024
@vstinner @JohnJamesUtley
[3.9] gh-103848: Adds checks to ensure that bracketed hosts found by … …
ddca295 
…urlsplit are of IPv6 or IPvFuture format (#103849) (#126976)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
ambv pushed a commit that referenced this pull request Dec 2, 2024
@vstinner @JohnJamesUtley
[3.10] gh-103848: Adds checks to ensure that bracketed hosts found by… …
634ded4 
… urlsplit are of IPv6 or IPvFuture format (#103849) (#126975)

Co-authored-by: Gregory P. Smith <greg@krypto.org>
(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
sarahboyce pushed a commit to felixxm/django that referenced this pull request Dec 3, 2024
@felixxm @sarahboyce
[4.2.x] Refs CVE-2024-11168 -- Updated vendored _urlsplit() to proper… …
18dcf92 
…ly validate IPv6 and IPvFuture addresses.

Refs Python CVE-2024-11168. Django should not affected, but others who
incorrectly use internal function _urlsplit() with unsanitized input
could be at risk.

python/cpython#103849
sarahboyce pushed a commit to django/django that referenced this pull request Dec 3, 2024
@felixxm @sarahboyce
[4.2.x] Refs CVE-2024-11168 -- Updated vendored _urlsplit() to proper… …
f663277 
…ly validate IPv6 and IPvFuture addresses.

Refs Python CVE-2024-11168. Django should not affected, but others who
incorrectly use internal function _urlsplit() with unsanitized input
could be at risk.

python/cpython#103849
gentoo-bot pushed a commit to gentoo/cpython that referenced this pull request Apr 9, 2025
@miss-islington @JohnJamesUtley
@gpshead @mgorny
[3.11] pythongh-103848: Adds checks to ensure that bracketed hosts fo… …
28bc8e7 
…und by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849) (python#104349)

pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

* Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format

---------

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
hrnciar pushed a commit to fedora-python/cpython that referenced this pull request Apr 23, 2025
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness @hrnciar
00444: Security fix for CVE-2024-11168 …
38e5d6c 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
@sajjaphani sajjaphani mentioned this pull request May 19, 2025
Closed
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Jul 4, 2025
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness @hroncok
00444: Security fix for CVE-2024-11168 …
e40bece 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
frenzymadness added a commit to fedora-python/cpython that referenced this pull request Aug 12, 2025
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness
00444: Security fix for CVE-2024-11168 …
48dea74 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
hroncok pushed a commit to fedora-python/cpython that referenced this pull request Feb 3, 2026
@miss-islington @JohnJamesUtley
@gpshead @frenzymadness @hroncok
00444: Security fix for CVE-2024-11168 …
0258af6 
pythongh-103848: Adds checks to ensure that bracketed hosts found by urlsplit are of IPv6 or IPvFuture format (pythonGH-103849)

Tests are adjusted because Python <3.9 don't support scoped IPv6 addresses.

(cherry picked from commit 29f348e)

Co-authored-by: JohnJamesUtley <81572567+JohnJamesUtley@users.noreply.github.com>
Co-authored-by: Gregory P. Smith <greg@krypto.org>
Co-authored-by: Lumír Balhar <lbalhar@redhat.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@gpshead gpshead gpshead approved these changes

Assignees

@gpshead gpshead

Labels

stdlib type-bug An unexpected behavior, bug, or error

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

8 participants

@JohnJamesUtley @bedevere-bot @miss-islington @BitterDone @CharlieZhao95 @gpshead @arhadthedev @JamesJohnUtley