High · published February 17, 2023
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
| Product | Versions | Fixed in |
|---|---|---|
| python/python | < 3.7.17 | 3.7.17 |
| python/python | ≥ 3.8.0, < 3.8.17 | 3.8.17 |
| python/python | ≥ 3.9.0, < 3.9.17 | 3.9.17 |
| python/python | ≥ 3.10.0, < 3.10.12 | 3.10.12 |
| python/python | ≥ 3.11.0, < 3.11.4 | 3.11.4 |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| fedoraproject/fedora | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/active_iq_unified_manager | all versions | — |
| netapp/management_services_for_element_software | all versions | — |
| netapp/management_services_for_netapp_hci | all versions | — |
| netapp/ontap_select_deploy_administration_utility | all versions | — |