WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.
Metrics
Affected Vendors & Products
References
History
Thu, 19 Sep 2024 19:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Redhat
Redhat openstack |
|
CPEs | cpe:/a:redhat:openstack:18.0::el9 | |
Vendors & Products |
Redhat
Redhat openstack |
Mon, 19 Aug 2024 19:00:00 +0000
Type | Values Removed | Values Added |
---|---|---|
First Time appeared |
Pylonsproject
Pylonsproject webob |
|
CPEs | cpe:2.3:a:pylonsproject:webob:*:*:*:*:*:*:*:* | |
Vendors & Products |
Pylonsproject
Pylonsproject webob |
Fri, 16 Aug 2024 13:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
References |
| |
Metrics |
threat_severity
|
threat_severity
|
Thu, 15 Aug 2024 14:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
Wed, 14 Aug 2024 20:30:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Description | WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8. | |
Title | WebOb's location header normalization during redirect leads to open redirect | |
Weaknesses | CWE-601 | |
References |
| |
Metrics |
cvssV3_1
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published: 2024-08-14T20:12:30.077Z
Updated: 2024-08-15T14:04:01.806Z
Reserved: 2024-07-30T14:01:33.922Z
Link: CVE-2024-42353
Vulnrichment
Updated: 2024-08-15T14:03:57.373Z
NVD
Status : Analyzed
Published: 2024-08-14T21:15:17.073
Modified: 2024-08-19T18:44:59.903
Link: CVE-2024-42353
Redhat