7.5

CVE-2023-24329: fedoraproject fedora Improper Input Validation

Modified
AliasesSUSE-SU-2023:0662-1SUSE-SU-2023:0736-1SUSE-SU-2023:0868-1
Published 17-02-2023Last modified 14-10-2026

Vulnerability summary

CVE-2023-24329 is a high (CVSS 7.5) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 20.46% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (reference, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.5/10
010
High · v3.1 (CVE.org)
EPSS score
20.46%
0%100%
High · 0.00 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 21 · Related 23

Timeline

  1. 17-02-2023
    PublishedVulnerability first disclosed.
  2. 14-10-2026
    Last modifiedVulnerability information updated.

Description

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

20.46%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

No change 0.00 pp

From 20.46% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (pointernull.com)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Redhat166 products
  • babel< 0:2.5.1-9.module+el8.1.0+3111+de3f2d8e | < 0:2.5.1-10.module+el8.5.0+11014+88fc0d0b | < 0:2.7.0-11.module+el8.5.0+11015+9c1c7c42 | < 0:2.7.0-10.module+el8.4.0+8888+89bc7e79 | < 0:2.7.0-10.module+el8.2.0+5234+f98739b6
  • Cython< 0:0.29.21-5.module+el8.4.0+9822+20bf1249 | < 0:0.28.1-7.module+el8.1.0+3111+de3f2d8e | < 0:0.29.14-4.module+el8.4.0+8888+89bc7e79 | < 0:0.29.14-4.module+el8.2.0+5234+f98739b6
  • Cython-debugsource< 0:0.29.21-5.module+el8.4.0+9822+20bf1249 | < 0:0.28.1-7.module+el8.1.0+3111+de3f2d8e | < 0:0.29.14-4.module+el8.4.0+8888+89bc7e79 | < 0:0.29.14-4.module+el8.2.0+5234+f98739b6
  • mod_wsgi< 0:4.7.1-4.module+el8.4.0+9822+20bf1249 | < 0:4.6.8-4.module+el8.7.0+16653+23ccaf52 | < 0:4.7.1-5.module+el8.7.0+16654+645aad7f | < 0:4.6.8-3.module+el8.4.0+8888+89bc7e79 | < 0:4.6.8-3.module+el8.2.0+5234+f98739b6
  • numpy< 0:1.19.4-3.module+el8.5.0+12204+54860423 | < 1:1.14.2-13.module+el8.1.0+3323+7ac3e00f | < 1:1.14.2-16.module+el8.4.0+9406+221a4565 | < 0:1.17.3-6.module+el8.5.0+12205+a865257a | < 0:1.19.4-2.module+el8.4.0+15042+dc5a279b.1 | < 0:1.17.3-5.module+el8.4.0+15041+cb41100f.1 | < 0:1.17.3-5.module+el8.2.0+5978+503155c0
Opensuse10 products
  • python-yarl&distro=openSUSE Tumbleweed< 1.8.2-3.1
  • python3-core&distro=openSUSE Leap 15.4< 3.6.15-150300.10.45.1
  • python3-core&distro=openSUSE Leap Micro 5.3< 3.6.15-150300.10.45.1
  • python3-documentation&distro=openSUSE Leap 15.4< 3.6.15-150300.10.45.1
  • python310&distro=openSUSE Tumbleweed< 3.10.10-1.1
Ubuntu9 products
  • python2.7< 2.7.18-1~20.04.7 | < 2.7.18-13ubuntu1.5 | < 2.7.6-8ubuntu0.6+esm14 | < 2.7.12-1ubuntu0~16.04.18+esm4 | < 2.7.17-1~18.04ubuntu1.11 | < 2.7.6-8ubuntu0.6+esm15 | < 2.7.12-1ubuntu0~16.04.18+esm5 | < 2.7.17-1~18.04ubuntu1.13
  • python3.10< 3.10.6-1~22.04.2ubuntu1 | < 3.10.6-1~22.04.2ubuntu1.1
  • python3.11< 3.11.0~rc1-1~22.04.1~esm1
  • python3.4All versions (No fix recorded)
  • python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.13+esm7 | < 3.5.2-2ubuntu0~16.04.13+esm8
Chainguard4 products
  • python-3.10All versions (No fix recorded)
  • python-3.11All versions (No fix recorded)
  • python-3.12All versions (No fix recorded)
  • python-3.9< 3.9.17-r0
Netapp4 products
Wolfi3 products
  • python-3.10All versions (No fix recorded)
  • python-3.11All versions (No fix recorded)
  • python-3.12All versions (No fix recorded)
Debian2 products
  • pypy3< 7.3.11+dfsg-2+deb12u2 | < 7.3.12+dfsg-1
  • python3.11< 3.11.2-6+deb12u2
Fedoraproject1 product
Python1 product
  • python< 3.7.17 | ≥ 3.8.0, < 3.8.17 | ≥ 3.9.0, < 3.9.17 | ≥ 3.10.0, < 3.10.12 | ≥ 3.11.0, < 3.11.4

9 vendors · 200 products · Showing 200 of 401

References

105 links
Show all 100 references

Showing 100 of 105.