Skip to content

[Security] A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages! #76266

@vstinner

Description

@vstinner
BPO 32085
Nosy @vstinner, @tiran, @vadmium, @csabella, @orangetw
Dependencies
  • bpo-30458: [security][CVE-2019-9740][CVE-2019-9947] HTTP Header Injection (follow-up of CVE-2016-5699)
  • bpo-32185: SSLContext.wrap_socket sends SNI Extension when server_hostname is IP
  • Note: these values reflect the state of the issue at the time it was migrated and might not reflect the current state.

    Show more details

    GitHub fields:

    assignee = None
    closed_at = <Date 2021-09-21.22:21:09.158>
    created_at = <Date 2017-11-20.14:15:17.542>
    labels = ['type-security']
    title = '[Security] A New Era of SSRF - Exploiting URL Parser in Trending Programming Languages!'
    updated_at = <Date 2021-09-21.22:21:09.157>
    user = 'https://github.com/vstinner'

    bugs.python.org fields:

    activity = <Date 2021-09-21.22:21:09.157>
    actor = 'vstinner'
    assignee = 'none'
    closed = True
    closed_date = <Date 2021-09-21.22:21:09.158>
    closer = 'vstinner'
    components = []
    creation = <Date 2017-11-20.14:15:17.542>
    creator = 'vstinner'
    dependencies = ['30458', '32185']
    files = []
    hgrepos = []
    issue_num = 32085
    keywords = []
    message_count = 5.0
    messages = ['306543', '306980', '307418', '313709', '402393']
    nosy_count = 5.0
    nosy_names = ['vstinner', 'christian.heimes', 'martin.panter', 'cheryl.sabella', 'orange']
    pr_nums = []
    priority = 'normal'
    resolution = 'out of date'
    stage = 'resolved'
    status = 'closed'
    superseder = None
    type = 'security'
    url = 'https://bugs.python.org/issue32085'
    versions = []

    Metadata

    Metadata

    Assignees

    No one assigned

      Labels

      Projects

      No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions