Threats tagged 'bit-libpython-2024-11168'

Libpython's urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts, allowing hosts that were not valid IPv6 or IPvFuture addresses. This non-conformance with RFC 3986 could potentially enable Server-Side Request Forgery (SSRF) if a URL is processed by multiple URL parsers. The issue affects multiple versions of libpython and has been fixed in versions 3.9.21, 3.10.16, and 3.11.4.