CVE-2024-42353
2 advisories.
PyPI/webob CVE-2024-42353: medium 6.1, EPSS 0.57%
WebOb's location header normalization during redirect leads to open redirect
Action: Upgrade webob to 1.8.8 or later.
pip install webob==1.8.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.8.8 | - |
Fixed versions
| 1.8.8 |
Sources
- osv: GHSA-mg3v-6m49-jhp3
- https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3
- https://nvd.nist.gov/vuln/detail/CVE-2024-42353
- https://github.com/Pylons/webob/commit/f689bcf4f0a1f64f1735b1d5069aef5be6974b5b
- https://github.com/Pylons/webob
- https://github.com/pypa/advisory-database/tree/main/vulns/webob/PYSEC-2024-188.yaml
CVE-2024-42353 · published · modified · JSON
PyPI/webob CVE-2024-42353: medium 6.1, EPSS 0.57%
WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected
Action: Upgrade webob to 1.8.8 or later.
pip install webob==1.8.8Affected
| introduced | fixed | last affected |
|---|---|---|
| 0 | 1.8.8 | - |
Fixed versions
| 1.8.8 |
Sources
- osv: PYSEC-2024-188
- https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3
- https://github.com/Pylons/webob/commit/f689bcf4f0a1f64f1735b1d5069aef5be6974b5b
CVE-2024-42353 · published · modified · JSON