Sara Gao

Name of the Vulnerable Software and Affected Versions: WebOb versions prior to 1.8.8 Description: The issue is related to the handling of HTTP Location headers in WebOb, where the `urlparse` and `urljoin` functions can be exploited to redirect users to arbitrary URLs. This occurs when the `urlparse` function treats a string starting with `//` as a URI without a scheme, and the `urljoin` function uses the hostname from the second part of the string, replacing the original hostname from the request. This can allow a remote attacker to redirect users to malicious sites. Recommendations: For WebOb versions prior to 1.8.8, upgrade to version 1.8.8 to patch the vulnerability. As a temporary workaround, consider rewriting any use of the `Response` class that includes a `location` to always pass a full URI that includes the hostname to redirect the user to. Restrict access to the vulnerable `urlparse` and `urljoin` functions to minimize the risk of exploitation. Avoid using the `//` notation at the start of URLs to prevent potential redirects to malicious sites.