CVE-2024-42353
Publication date 14 August 2024
Last updated 17 September 2026
Ubuntu priority
Description
WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| python-webob | 26.04 LTS resolute |
Fixed 1:1.8.7-1ubuntu1
|
| 24.04 LTS noble |
Fixed 1:1.8.7-1ubuntu0.1.24.04.1
|
|
| 22.04 LTS jammy |
Fixed 1:1.8.6-1.1ubuntu0.1
|
|
| 20.04 LTS focal |
Fixed 1:1.8.5-2ubuntu0.1
|
|
| 18.04 LTS bionic |
Fixed 1:1.7.3-2ubuntu0.1~esm2
|
|
| 16.04 LTS xenial |
Fixed 1.5.1-1ubuntu0.1~esm2
|
Get expanded security coverage with Ubuntu Pro
Reduce your average CVE exposure time from 98 days to 1 day with expanded CVE patching, ten-years security maintenance and optional support for the full stack of open-source applications. Free for personal use.
Get Ubuntu Pro 30-day free trialSeverity score breakdown
CVSS version: CVSS v3.0
Base score
6.1 · Medium
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
References
Related Ubuntu Security Notices (USN)
- USN-6984-1
- WebOb vulnerability
- 2 September 2024
- USN-8759-1
- WebOb vulnerabilities
- 15 September 2026