The compliance-trestle tool in oscal-compass versions before 3.12.2 and 4.0.3 contains an SSRF vulnerability (CWE-918) due to the HTTPSFetcher._do_fetch() method passing user-supplied URLs directly to the requests.get() function without validation. This enables attackers with low privileges and requiring user interaction to coerce the server into making HTTP requests to internal or cloud metadata endpoints, potentially exposing sensitive information. The vulnerability has a CVSS 3.1 score of 6.7 (medium severity) with an attack vector of local access, low attack complexity, and partial confidentiality impact. The vulnerability is fixed in versions 3.12.2 and 4.0.3.

An attacker with local privileges and requiring user interaction can exploit this SSRF vulnerability to make the server perform unauthorized HTTP requests to internal network services or cloud metadata endpoints. This can lead to high confidentiality impact by exposing sensitive internal information. Integrity impact is low, and availability is not affected.

Upgrade compliance-trestle to version 3.12.2 or later, or 4.0.3 or later, where the SSRF vulnerability is fixed. Patch status is confirmed by the version information provided. No additional vendor advisory is available to indicate alternative mitigations or that no action is required.