[4.2.x] Refs CVE-2024-11168 -- Updated vendored _urlsplit() to properly validate IPv6 and IPvFuture addresses. #18872
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
felixxm
force-pushed
the
backport-cpython-103848
branch
from
28cf7c3 to
7933946
Compare
|
Failures on Python 3.13 are expected since Django 4.2 doesn't support it. |
ngnpope
approved these changes
Dec 2, 2024
felixxm
commented
Dec 2, 2024
felixxm
force-pushed
the
backport-cpython-103848
branch
from
7933946 to
fe8d4ca
Compare
…ly validate IPv6 and IPvFuture addresses. Refs Python CVE-2024-11168. Django should not affected, but others who incorrectly use internal function _urlsplit() with unsanitized input could be at risk. python/cpython#103849
sarahboyce
force-pushed
the
backport-cpython-103848
branch
from
fe8d4ca to
18dcf92
Compare
sarahboyce
approved these changes
Dec 3, 2024
Thanks 👍 |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Refs Python CVE-2024-11168. Django should not affected, but others who incorrectly use internal function
_urlsplit()with unsanitized input could be at risk.python/cpython#103849
https://www.cve.org/cverecord?id=CVE-2024-11168