Repository navigation
Backport CVE-2023-24329 to all in-service releases: urlparse does not correctly handle schemes that begin with ASCII digits, '+', '-', and '.' characters #102293
Description
Feature or enhancement
Backport CVE-2023-24329 (CVSS 7.5: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N) to all in-service releases: urlparse does not correctly handle schemes that begin with ASCII digits, '+', '-', and '.' characters which was backported to 3.11.1 only
Pitch
This is a security vulnerability that has only been backported to 3.11.1, not the other releases (3.7-3.10) that are currently supported.
Previous discussion
Is it possible to get an idea of a timescale for such as backport to be implemented in the earlier supported releases?
Activity
gpshead commentedon Feb 27, 2023
I'm closing this as a duplicate of #102153 as it isn't clear that all of this was even fixed. We'll make any decision on what to backport it to there.