PT-2023-32967 · Pypi · Safeurl-Python

Published 2023-06-29 · Updated 2023-06-29

Positive Technologies (AI Summary)

Name of the Vulnerable Software and Affected Versions safeurl-python (affected versions not specified)

Description The issue allows bypassing of blacklisted hostnames by requesting the FQDN of the host, for example, by adding a . to the end. This could enable an attacker to circumvent blocks set by library users, potentially leading to Server-Side Request Forgery (SSRF) attacks to request those hostnames. The main library purpose of blocking internal or private IPs remains unaffected.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

GHSA-373W-RJ84-PV6X

Affected Products

Safeurl-Python

References · 5

• https://osv.dev/vulnerability/GHSA-373w-rj84-pv6x · Vendor Advisory
• https://github.com/IncludeSecurity/safeurl-python/security/advisories/GHSA-373w-rj84-pv6x · Note
• https://github.com/IncludeSecurity/safeurl-python · Note
• https://github.com/IncludeSecurity/safeurl-python/commit/c4f9677f8790a58eaa1953bac286cca75a5f580e · Note
• https://github.com/IncludeSecurity/safeurl-python/pull/6 · Note