CVE-2024-11168
MediumSummary
The urllib.parse.urlsplit() and urlparse() functions in Python improperly validate bracketed hosts (`[]`), accepting hosts that are not IPv6 or IPvFuture. This violates RFC 3986 and could enable SSRF attacks if a URL is processed by multiple URL parsers.
Risk Assessment
An attacker could exploit this to perform SSRF attacks, potentially gaining unauthorized access to internal network resources.
Recommendation
Update Python to a version that fixes host validation in square brackets, and avoid processing URLs through multiple parsers.
Original NVD description (English source)
The urllib.parse.urlsplit() and urlparse() functions improperly validated bracketed hosts (`[]`), allowing hosts that weren't IPv6 or IPvFuture. This behavior was not conformant to RFC 3986 and potentially enabled SSRF if a URL is processed by more than one URL parser.