huzaifas-sidhpurwala/security-commit huggingface dataset:
CVE-2024-6387: openssh: regreSSHion - race condition in SSH allows RCE/DoS
Component: openssh
Severity: Important
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 8.1 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-07-01T08:00:00+00:00

A security regression (CVE-2006-5051) was discovered in OpenSSH's server (sshd). There is a race condition which can lead sshd to handle some signals in an unsafe manner. An unauthenticated, remote attacker may be able to trigger it by failing to authenticate within a set time period.

Statement: Red Hat rates the severity of this flaw as Important for both Red Hat Enterprise Linux (RHEL) and OpenShift Container Platform (OCP). The most significant risk is Remote Code Execution, however this outcome requires significant resources to exploit. If mitigations are put in place, the consequences of exploitation are reduced. An attacker would then only be able to impact availability of the OpenSSH service.

The main factor preventing a higher impact rating is an unpredictable race condition. All actively supported versions of RHEL (and by extension OCP) have ExecShield (aka ASLR) enabled by default and utilize NX technology, reducing reliability of the attack. Attackers are forced to retry the attack thousands of times. This generates significant noise providing defenders with an opportunity to detect and disrupt potential attacks.

RHEL 9 is the only affected version. RHEL 6, 7, and 8 all utilize an older version of OpenSSH which was never affected by this vulnerability.

The affected versions of OCP are 4.13, 4.14, 4.15, and 4.16 as they include the affected version of OpenSSH in the underlying operating system Red Hat CoreOS (RHCOS). 4.12 and earlier versions of OCP are not affected.

Affected upstream versions: 8.5p1 <= 9.7p1
Fixed upstream versions: 0:8.7p1-12.el9_0.1, 0:8.7p1-30.el9_2.4, 0:8.7p1-38.el9_4.1, 413.92.202407091321-0, 414.92.202407091253-0, 415.92.202407091355-0, 416.94.202407081958-0
Upstream repository: https://github.com/openela-main/openssh
Upstream fix commit: e1f438970e5a337a17070a637c1b9e19697cad09
CVE-2024-6409: openssh: Possible remote code execution due to a race condition in signal handling affecting Red Hat Enterprise Linux 9
Component: openssh
Severity: Moderate
CWE: CWE-364 (Signal Handler Race Condition)
CVSS v3: 7 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H)
Public date: 2024-07-08T17:45:07+00:00

A race condition vulnerability was discovered in how signals are handled by OpenSSH's server (sshd). If a remote attacker does not authenticate within a set time period, then sshd's SIGALRM handler is called asynchronously. However, this signal handler calls various functions that are not async-signal-safe, for example, syslog(). As a consequence of a successful attack, in the worst case scenario, an attacker may be able to perform a remote code execution (RCE) as an unprivileged user running the sshd server.

Statement: Red Hat rates the severity of this flaw as Moderate for both Red Hat Enterprise Linux (RHEL) and OpenShift Container Platform (OCP). While there are many similarities to CVE-2024-6387, the important difference is that any possible remote code execution is limited to an unprivileged child of the SSHD server. This additional restriction on access reduces the overall security impact.

This vulnerability only affects the versions of OpenSSH shipped with Red Hat Enterprise Linux 9. Upstream versions of sshd are not impacted by this flaw.

The affected versions of OCP are 4.13, 4.14, 4.15, and 4.16 while 4.12 and earlier versions of OCP are not affected.

Affected upstream versions: <= imports/el9/openssh-8.7p1-38.el9_4.1
Fixed upstream versions: 0:8.7p1-12.el9_0.3, 0:8.7p1-30.el9_2.7, 0:8.7p1-38.el9_4.4, 413.92.202408122222-0, 414.92.202407300859-0, 415.92.202407301159-0, 416.94.202407171205-0
Upstream repository: https://github.com/openela-main/openssh
Upstream fix commit: c00da7741d42029e49047dd89e266d91dcfbffa0
CVE-2024-6923: cpython: python: email module doesn't properly quotes newlines in email headers, allowing header injection
Component: cpython
Severity: Moderate
CVSS v3: 6.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N)
Public date: 2024-08-01T00:00:00+00:00

A vulnerability was found in the email module that uses Python language. The email module doesn't properly quote new lines in email headers. This flaw allows an attacker to inject email headers that could, among other possibilities, add hidden email destinations or inject content into the email, impacting data confidentiality and integrity.

Statement: Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Affected upstream versions: 3.9.0 < 3.9.20, 3.10.0 < 3.10.15, 3.11.0 < 3.11.10, 3.12.0 < 3.12.5, 3.13.0a1 < 3.13.0rc2
Fixed upstream versions: v3.12.5
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 4766d1200fdf8b6728137aa2927a297e224d5fa7
CVE-2024-7254: protobuf: StackOverflow vulnerability in Protocol Buffers
Component: protobuf
Severity: Important
CWE: CWE-770 (Allocation of Resources Without Limits or Throttling)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-09-19T01:15:10.963000+00:00

A flaw was found in Protocol Buffers (protobuf). This issue can allows an attacker to cause a StackOverflow via parsing untrusted Protocol Buffers data containing arbitrarily nested SGROUP tags, leading to unbounded recursion.

Statement: This issue represents a significant severity risk because unbounded recursion in Protocol Buffers parsing can be exploited to trigger stack overflows, leading to Denial of Service (DoS). When parsers, such as `DiscardUnknownFieldsParser` or the Java Protobuf Lite parser, encounter arbitrarily nested groups or deeply recursive map fields, the lack of recursion depth limits can result in uncontrolled stack growth. Attackers can craft malicious protobuf messages that deliberately exceed the stack's capacity, causing the application to crash or become unresponsive.

The protobuf package as shipped in RHEL does not include the affected java or kotlin bindings, therefore RHEL is Not Affected.

Affected upstream versions: <= v25.0
Fixed upstream versions: 28.2, 3.25.5, 4.27.5, 4.28.2
Upstream repository: https://github.com/protocolbuffers/protobuf
Upstream fix commit: cc8b3483a5584b3301e3d43d17eb59704857ffaa
CVE-2024-7264: curl: libcurl: ASN.1 date parser overread
Component: curl
Severity: Low
CWE: CWE-125 (Out-of-bounds Read)
CVSS v3: 5.3 (CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:H)
Public date: 2024-07-31T00:00:00+00:00

A flaw was found in libcurl, where libcurl's ASN1 parser code has the `GTime2str()` function, used for parsing an ASN.1 Generalized Time field. If a syntactically incorrect field is given, the parser can use -1 for the length of the *time fraction*, leading to a `strlen()` performed on a pointer to a heap buffer area that is not purposely NULL terminated.

Statement: The vulnerability is classified as low severity because it primarily results in a heap buffer over-read rather than a direct memory corruption or code execution risk. Since the ASN.1 parsing occurs after a successful TLS handshake, the malformed certificate must first bypass the TLS library's validation, which significantly reduces the likelihood of exploitation. 

Additionally, the impact is limited to a potential crash or unintended heap data exposure through CURLINFO_CERTINFO, but not arbitrary code execution. The requirement for a specific TLS backend configuration and the controlled nature of the memory read further minimize its exploitability.

Affected upstream versions: 8.9.0 <= 8.9.0, 8.8.0 <= 8.8.0, 8.7.1 <= 8.7.1, 8.7.0 <= 8.7.0, 8.6.0 <= 8.6.0, 8.5.0 <= 8.5.0, 8.4.0 <= 8.4.0, 8.3.0 <= 8.3.0, 8.2.1 <= 8.2.1, 8.2.0 <= 8.2.0, 8.1.2 <= 8.1.2, 8.1.1 <= 8.1.1, 8.1.0 <= 8.1.0, 8.0.1 <= 8.0.1, 8.0.0 <= 8.0.0, 7.88.1 <= 7.88.1, 7.88.0 <= 7.88.0, 7.87.0 <= 7.87.0, 7.86.0 <= 7.86.0, 7.85.0 <= 7.85.0
Fixed upstream versions: curl-8_9_1
Upstream repository: https://github.com/curl/curl
Upstream fix commit: 27959ecce75cdb2809c0bdb3286e60e08fadb519
CVE-2024-7387: openshift/builder: Path traversal allows command injection in privileged BuildContainer using docker build strategy
Component: openshift/builder
Severity: Important
CWE: CWE-250 (Execution with Unnecessary Privileges)
CVSS v3: 9.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H)
Public date: 2024-09-16T08:00:00+00:00

A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the “Docker” strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.

Statement: In all versions of OpenShift, the "Custom" build strategy gives developers permission to run arbitrary commands in a privileged container. This is disabled by default, and documentation explicitly warns that this should only be enabled for highly trusted users (eg: cluster admins). We therefore do not consider this vulnerability a privilege escalation path for "Custom" strategy builds.

Microshift is not affected by this vulnerability. MicroShift does not include this OpenShift API.

The Builds for Red Hat OpenShift Operator based on Shipwright is not affected by this vulnerability.

Affected upstream versions: <= v4.0.0
Fixed upstream versions: v4.12.0-202409121032.p1.g609473f.assembly.stream.el8, v4.13.0-202409120505.p1.g2c7e99d.assembly.stream.el8, v4.14.0-202409111409.p1.g52565ca.assembly.stream.el8, v4.15.0-202409101936.p1.ge7749a3.assembly.stream.el8, v4.16.0-202409101737.p1.gfee4b58.assembly.stream.el9, v4.17.0-202409122005.p1.gcfcf3bd.assembly.stream.el9
Upstream repository: https://github.com/openshift/builder
Upstream fix commit: 0b62633adfa2836465202bc851885e078ec888d1
CVE-2024-7592: cpython: python: Uncontrolled CPU resource consumption when in http.cookies module
Component: cpython
Severity: Low
CWE: CWE-400 (Uncontrolled Resource Consumption)
CVSS v3: 4.8 (CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-08-19T00:00:00+00:00

A flaw was found in the `http.cookies` module in the Python package. When parsing cookies that contain backslashes, under certain circumstances, the module uses an algorithm with quadratic complexity, leading to excessive CPU consumption.

Statement: This vulnerability is classified as low severity, as also marked by upstream Python, because while it can cause excessive CPU usage, its exploitability is constrained by practical factors. Most production environments enforce request size limits (e.g., via web servers like Nginx or Apache), preventing attackers from sending arbitrarily large cookies. 

Additionally, the impact is localized to individual requests, meaning it does not persistently degrade system performance or lead to remote code execution (RCE). The attack requires multiple large requests to have a significant effect, making it inefficient compared to more severe denial-of-service (DoS) vectors.

Affected upstream versions: 3.9.0 < 3.9.20, 3.10.0 < 3.10.15, 3.11.0 < 3.11.10, 3.12.0 < 3.12.6, 3.13.0a1 < 3.13.0rc2
Fixed upstream versions: v3.13.0
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 391e5626e3ee5af267b97e37abc7475732e67621
CVE-2024-8088: python: cpython: Iterating over a malicious ZIP file may lead to Denial of Service
Component: python
Severity: Moderate
CWE: CWE-835 (Loop with Unreachable Exit Condition ('Infinite Loop'))
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H)
Public date: 2024-08-22T19:15:09.720000+00:00

A flaw was found in Python's zipfile module. When iterating over the entries of a zip archive, the process can enter into an infinite loop state and become unresponsive. This flaw allows an attacker to craft a malicious ZIP archive, leading to a denial of service from the application consuming the zipfile module. Only applications that handle user-controlled zip archives are affected by this vulnerability.

Statement: Versions of python36:3.6/python36 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Affected upstream versions: 3.9.0 < 3.9.20, 3.10.0 < 3.10.15, 3.11.0 < 3.11.10, 3.12.0 < 3.12.6, 3.13.0a1 < 3.13.0rc2
Fixed upstream versions: v3.11.10
Upstream repository: https://github.com/python/cpython
Upstream fix commit: 795f2597a4be988e2bb19b69ff9958e981cb894e
CVE-2024-8176: libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat
Component: libexpat
Severity: Moderate
CWE: CWE-674 (Uncontrolled Recursion)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2025-03-13T13:51:54.957000+00:00

A stack overflow vulnerability exists in the libexpat library due to the way it handles recursive entity expansion in XML documents. When parsing an XML document with deeply nested entity references, libexpat can be forced to recurse indefinitely, exhausting the stack space and causing a crash. This issue could lead to denial of service (DoS) or, in some cases, exploitable memory corruption, depending on the environment and library usage.

Statement: All supported Red Hat offerings are built with the compilation flag (-fstack-clash-protection) which reduces the impact to Moderate. This build configuration blocks the possibility of an attacker gaining arbitrary code execution even if a stack-clash vulnerability, like this one, could be exploited.

This vulnerability is rated Moderate because Red Hat builds use the `-fstack-clash-protection` compiler flag, which mitigates the risk of arbitrary code execution from stack overflows. While the flaw allows a crash via uncontrolled recursion in XML parsing, the hardened stack layout prevents reliable memory corruption, limiting the impact to a Denial of Service (DoS) scenario.

Affected upstream versions: <= v20250108
Fixed upstream versions: 0.33-1744075017, 0:1.51.0-11.el8_10, 0:1.51.0-5.el8_2.2, 0:1.51.0-5.el8_4.2, 0:1.51.0-6.el8_6.1, 0:1.51.0-8.el8_8.1, 0:2.2.10-1.el8_2, 0:2.2.10-1.el8_4, 0:2.2.10-1.el8_6, 0:2.2.10-1.el8_8, 0:2.2.10-12.el9_0.4, 0:2.2.5-17.el8_10, 0:2.5.0-1.el9_2.3, 0:2.5.0-2.el9_4.3, 0:2.5.0-3.el9_5.3, 0:2.5.0-5.el9_6, 0:2.7.1-1.el10_0, 1.14.2-1748467619, 1.14.3-1748529279, 2.7.0
Upstream repository: https://gitlab.alpinelinux.org/alpine/aports
Upstream fix commit: d068c3ff36fc6f4789988a09c69b434db757db53
CVE-2024-8376: mosquitto: sending specific sequences of packets may trigger memory leak
Component: mosquitto
Severity: Important
CWE: CWE-825 (Expired Pointer Dereference)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-11T15:18:54.142000+00:00

A flaw was found in Eclipse Mosquitto. A remote attacker may be able to trigger memory leakage, segmentation fault, or a heap-use-after-free condition by sending specific sequences of "CONNECT", "DISCONNECT", "SUBSCRIBE", "UNSUBSCRIBE", and "PUBLISH" packets.


Affected upstream versions: 2.0.18
Fixed upstream versions: 2.0.19
Upstream repository: https://github.com/eclipse-mosquitto/mosquitto
Upstream fix commit: 1914b3ee2a18102d0a94cbdbbfeae1afa03edd17
CVE-2024-8925: php: Erroneous parsing of multipart form data
Component: php
Severity: Moderate
CWE: CWE-1286 (Improper Validation of Syntactic Correctness of Input)
CVSS v3: 5.3 (CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:N)
Public date: 2024-10-07T00:00:00+00:00

A flaw was found in PHP's parsing of multipart form data contents, which affects both file and input form data. This may lead to legitimate data not being processed, violating data integrity. For example, if a multipart form data payload contains a valid prefix 'X' of the defined boundary B such that 5Kib < |X| < |B| < 8Kib, the logic responsible for parsing and storing the multipart payload fails to correctly extract the contents between two boundaries.


Affected upstream versions: 8.1.* < 8.1.30, 8.2.* < 8.2.24, 8.3.* < 8.3.12
Fixed upstream versions: 8.1.30, 8.2.24, 8.3.12
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 48808d98f4fc2a05193cdcc1aedd6c66816450f1
CVE-2024-8927: php: cgi.force_redirect configuration is bypassable due to the environment variable collision
Component: php
Severity: Moderate
CWE: CWE-1220 (Insufficient Granularity of Access Control)
CVSS v3: 7.5 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
Public date: 2024-10-07T00:00:00+00:00

A flaw was found in PHP. The configuration directive `cgi.force_redirect` prevents anyone from calling PHP directly with a URL such as http://host.example/cgi-bin/php/secretdir/script.php. However, in certain uncommon configurations, an attacker may be able to bypass this restriction and access php-cgi directly.

Statement: This vulnerability is rated as a moderate severity because the risk is limited, it poses a potential threat to the confidentiality of data.

Affected upstream versions: 8.1.* < 8.1.30, 8.2.* < 8.2.24, 8.3.* < 8.3.12
Fixed upstream versions: 8.1.30, 8.2.24, 8.3.12
Upstream repository: https://github.com/php/php-src
Upstream fix commit: 48808d98f4fc2a05193cdcc1aedd6c66816450f1
CVE-2024-9050: NetworkManager-libreswan: Local privilege escalation via leftupdown
Component: NetworkManager-libreswan
Severity: Important
CWE: CWE-94 (Improper Control of Generation of Code ('Code Injection'))
CVSS v3: 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Public date: 2024-10-22T12:00:00+00:00

A flaw was found in the libreswan client plugin for NetworkManager (NetkworkManager-libreswan), where it fails to properly sanitize the VPN configuration from the local unprivileged user. In this configuration, composed by a key-value format, the plugin fails to escape special characters, leading the application to interpret values as keys. One of the most critical parameters that could be abused by a malicious user is the `leftupdown`key. This key takes an executable command as a value and is used to specify what executes as a callback in NetworkManager-libreswan to retrieve configuration settings back to NetworkManager. As NetworkManager uses Polkit to allow an unprivileged user to control the system's network configuration, a malicious actor could achieve local privilege escalation and potential code execution as root in the targeted machine by creating a malicious configuration.

Statement: This issue marked with an Important severity due to its potential to enable local privilege escalation and arbitrary code execution. Since NetworkManager uses Polkit to allow unprivileged users to manage network configurations, the failure to properly sanitize the VPN configuration, particularly the `leftupdown` key, creates a direct attack vector. By leveraging this vulnerability, an attacker can inject malicious commands into the VPN configuration, bypassing user privilege boundaries and gaining root access.

Affected upstream versions: <= 1.2.22
Fixed upstream versions: 0:1.2.10-6.el8_2, 0:1.2.10-6.el8_4, 0:1.2.10-6.el8_6, 0:1.2.10-6.el8_8, 0:1.2.10-7.el8_10, 0:1.2.14-3.el9_0, 0:1.2.14-6.el9_2, 0:1.2.18-6.el9_4, 0:1.2.22-4.el9_5, 0:1.2.4-4.el7_7, 0:1.2.4-4.el7_9, 1.2.24
Upstream repository: https://gitlab.gnome.org/GNOME/NetworkManager-libreswan
Upstream fix commit: dcf8acfb25bd31e4b8cbd20c229da660238b5c1b
CVE-2024-9287: python: Virtual environment (venv) activation scripts don't quote paths
Component: python
Severity: Moderate
CWE: CWE-428 (Unquoted Search Path or Element)
CVSS v3: 6.3 (CVSS:3.1/AV:L/AC:L/PR:H/UI:R/S:C/C:L/I:H/A:N)
Public date: 2024-10-22T16:34:39.210000+00:00

A vulnerability has been found in the Python `venv` module and CLI. Path names provided when creating a virtual environment were not quoted properly, allowing the creator to inject commands into virtual environment "activation" scripts, for example, "source venv/bin/activate". This flaw allows attacker-controlled virtual environments to run commands when the virtual environment is activated.

Statement: This vulnerability in the Python `venv` module is rated as moderate rather than important because it relies on a specific set of conditions to be exploitable, limiting its impact. An attacker would need to have control over the virtual environment creation process and access to the environment setup, which is less common in typical usage scenarios. Furthermore, the vulnerability only poses a risk if users activate the malicious virtual environment through `source venv/bin/activate` or similar scripts, as direct invocation of the virtual environment without activation (`./venv/bin/python`) is not affected.

Versions of python36:3.6/python36 and python39:3.9/python39 as shipped with Red Hat Enterprise Linux 8 are marked as 'Not affected' as they just provide "symlinks" to the main python3 component, which provides the actual interpreter of the Python programming language.

Affected upstream versions: 3.10.0 < 3.10.16, 3.11.0 < 3.11.11, 3.12.0 < 3.12.8, 3.13.0 < 3.13.1, 3.14.0a1 < 3.14.0a2
Fixed upstream versions: v3.13.1
Upstream repository: https://github.com/python/cpython
Upstream fix commit: e52095a0c1005a87eed2276af7a1f2f66e2b6483
CVE-2024-9676: Podman: Buildah: CRI-O: symlink traversal vulnerability in the containers/storage library can cause Denial of Service (DoS)
Component: Podman
Severity: Moderate
CWE: CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
CVSS v3: 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Public date: 2024-10-15T15:00:00+00:00

A vulnerability was found in Podman, Buildah, and CRI-O. A symlink traversal vulnerability in the containers/storage library can cause Podman, Buildah, and CRI-O to hang and result in a denial of service via OOM kill when running a malicious image using an automatically assigned user namespace (`--userns=auto` in Podman and Buildah). The containers/storage library will read /etc/passwd inside the container, but does not properly validate if that file is a symlink, which can be used to cause the library to read an arbitrary file on the host.


Affected upstream versions: <= v1.55.0
Fixed upstream versions: 0:1.25.5-30.rhaos4.12.git53dc492.el8, 0:1.26.5-26.rhaos4.13.giteb3d487.el8, 0:1.27.8-12.rhaos4.14.git7597c43.el8, 0:1.28.11-5.rhaos4.15.git35a2431.el8, 0:1.29.9-6.rhaos4.16.gite7bd45a.el8, 0:1.30.6-6.rhaos4.17.git6ac6e96.el8, 1.55.1, 2:1.33.11-1.el9_4, 2:1.37.5-1.el9_5, 4:4.9.4-12.rhaos4.16.el8, 4:4.9.4-16.el9_4, 4:5.2.2-9.el9_5, 5:5.2.2-1.rhaos4.17.el8, 8100020241101101019.afee755d, v4.14.0-202503060906.p0.gb03f3f5.assembly.stream.el8, v4.15.0-202503060734.p0.gbc0b789.assembly.stream.el8, v4.16.0-202503121138.p0.g31c3c26.assembly.stream.el9, v4.17.0-202501281204.p0.ga753153.assembly.stream.el9
Upstream repository: https://github.com/containers/storage
Upstream fix commit: 935c58f4b3e364a9c9d33ed06476a831e6ad5679
CVE-2025-0938: python: cpython: URL parser allowed square brackets in domain names
Component: python
Severity: Moderate
CWE: CWE-20 (Improper Input Validation)
CVSS v3: 6.8 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N)
Public date: 2025-01-31T17:51:35.898000+00:00

A flaw was found in Python. The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accept domain names that included square brackets, which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.


Affected upstream versions: 3.11.0 < 3.11.12, 3.12.0 < 3.12.9, 3.13.0 < 3.13.2, 3.14.0a1 < 3.14.0a5
Fixed upstream versions: v3.14.0
Upstream repository: https://github.com/python/cpython
Upstream fix commit: d89a5f6a6e65511a5f6e0618c4c30a7aa5aba56a