CVE-2025-0938

Public on 2025-01-31
Modified on 2025-02-04
Description
The Python standard library functions `urllib.parse.urlsplit` and `urlparse` accepted domain names that included square brackets which isn't valid according to RFC 3986. Square brackets are only meant to be used as delimiters for specifying IPv6 and IPvFuture hosts in URLs. This could result in differential parsing across the Python URL parser and other specification-compliant URL parsers.
Severity
Medium severity
Medium
CVSS v3 Base Score
5.3
See breakdown

Affected Packages

Platform Package Release Date Advisory Status
HAQM Linux 2 - Core python 2025-03-13 ALAS2-2025-2797 Fixed
HAQM Linux 1 python26 No Fix Planned
HAQM Linux 1 python27 No Fix Planned
HAQM Linux 2 - Core python3 2025-03-26 ALAS2-2025-2815 Fixed
HAQM Linux 2023 python3.11 2025-02-26 ALAS2023-2025-871 Fixed
HAQM Linux 2023 python3.12 2025-03-13 ALAS2023-2025-899 Fixed
HAQM Linux 2023 python3.9 2025-03-13 ALAS2023-2025-898 Fixed
HAQM Linux 1 python34 No Fix Planned
HAQM Linux 1 python35 No Fix Planned
HAQM Linux 1 python36 No Fix Planned

CVSS Scores

Score Type Score Vector
HAQM Linux CVSSv3 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N