CVE-2023-24329: fedoraproject fedora Improper Input Validation
Vulnerability summary
CVE-2023-24329 is a high (CVSS 7.5) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 20.46% chance of exploitation in the next 30 days, higher than 97.5% of scored vulnerabilities. 1 public exploit is recorded.
Public exploit (reference, Date unknown)
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 21 · Related 23Timeline
- 17-02-2023PublishedVulnerability first disclosed.
- 14-10-2026Last modifiedVulnerability information updated.
Description
An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · Red hatEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
EPSS trend
Probability
20.46%
Chance of exploitation in the next 30 days
Percentile
98%
Versus all other CVEs
30-day change
No change 0.00 pp
From 20.46% on 04-10-2026
Known exploited
Compare KEV catalogsNot in the CISA KEV catalog.
Not in the ENISA CNW catalog.
Not in the CIRCL catalog.
Public exploits
1 foundExploit Reference (pointernull.com)
Maturity: unknown
Weaknesses
CWE · root causeAffected systems
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Redhat166 products
- babel< 0:2.5.1-9.module+el8.1.0+3111+de3f2d8e | < 0:2.5.1-10.module+el8.5.0+11014+88fc0d0b | < 0:2.7.0-11.module+el8.5.0+11015+9c1c7c42 | < 0:2.7.0-10.module+el8.4.0+8888+89bc7e79 | < 0:2.7.0-10.module+el8.2.0+5234+f98739b6
- Cython< 0:0.29.21-5.module+el8.4.0+9822+20bf1249 | < 0:0.28.1-7.module+el8.1.0+3111+de3f2d8e | < 0:0.29.14-4.module+el8.4.0+8888+89bc7e79 | < 0:0.29.14-4.module+el8.2.0+5234+f98739b6
- Cython-debugsource< 0:0.29.21-5.module+el8.4.0+9822+20bf1249 | < 0:0.28.1-7.module+el8.1.0+3111+de3f2d8e | < 0:0.29.14-4.module+el8.4.0+8888+89bc7e79 | < 0:0.29.14-4.module+el8.2.0+5234+f98739b6
- mod_wsgi< 0:4.7.1-4.module+el8.4.0+9822+20bf1249 | < 0:4.6.8-4.module+el8.7.0+16653+23ccaf52 | < 0:4.7.1-5.module+el8.7.0+16654+645aad7f | < 0:4.6.8-3.module+el8.4.0+8888+89bc7e79 | < 0:4.6.8-3.module+el8.2.0+5234+f98739b6
- numpy< 0:1.19.4-3.module+el8.5.0+12204+54860423 | < 1:1.14.2-13.module+el8.1.0+3323+7ac3e00f | < 1:1.14.2-16.module+el8.4.0+9406+221a4565 | < 0:1.17.3-6.module+el8.5.0+12205+a865257a | < 0:1.19.4-2.module+el8.4.0+15042+dc5a279b.1 | < 0:1.17.3-5.module+el8.4.0+15041+cb41100f.1 | < 0:1.17.3-5.module+el8.2.0+5978+503155c0
Opensuse10 products
- python-yarl&distro=openSUSE Tumbleweed< 1.8.2-3.1
- python3-core&distro=openSUSE Leap 15.4< 3.6.15-150300.10.45.1
- python3-core&distro=openSUSE Leap Micro 5.3< 3.6.15-150300.10.45.1
- python3-documentation&distro=openSUSE Leap 15.4< 3.6.15-150300.10.45.1
- python310&distro=openSUSE Tumbleweed< 3.10.10-1.1
Ubuntu9 products
- python2.7< 2.7.18-1~20.04.7 | < 2.7.18-13ubuntu1.5 | < 2.7.6-8ubuntu0.6+esm14 | < 2.7.12-1ubuntu0~16.04.18+esm4 | < 2.7.17-1~18.04ubuntu1.11 | < 2.7.6-8ubuntu0.6+esm15 | < 2.7.12-1ubuntu0~16.04.18+esm5 | < 2.7.17-1~18.04ubuntu1.13
- python3.10< 3.10.6-1~22.04.2ubuntu1 | < 3.10.6-1~22.04.2ubuntu1.1
- python3.11< 3.11.0~rc1-1~22.04.1~esm1
- python3.4All versions (No fix recorded)
- python3.5< 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1 | < 3.5.2-2ubuntu0~16.04.13+esm7 | < 3.5.2-2ubuntu0~16.04.13+esm8
Chainguard4 products
- python-3.10All versions (No fix recorded)
- python-3.11All versions (No fix recorded)
- python-3.12All versions (No fix recorded)
- python-3.9< 3.9.17-r0
Netapp4 products
Wolfi3 products
- python-3.10All versions (No fix recorded)
- python-3.11All versions (No fix recorded)
- python-3.12All versions (No fix recorded)
Debian2 products
- pypy3< 7.3.11+dfsg-2+deb12u2 | < 7.3.12+dfsg-1
- python3.11< 3.11.2-6+deb12u2
Fedoraproject1 product
- fedoraEOL36 | 37 | 38
Python1 product
- python< 3.7.17 | ≥ 3.8.0, < 3.8.17 | ≥ 3.9.0, < 3.9.17 | ≥ 3.10.0, < 3.10.12 | ≥ 3.11.0, < 3.11.4
9 vendors · 200 products · Showing 200 of 401
References
105 links- pointernull.com/security/python-url-parse-problem.htmlARTICLEREPORTWEBExploitMitigationTechnical DescriptionThird Party Advisory
Show all 100 references
Showing 100 of 105.