The vulnerabilities of the functions urlparse() and urljoin() in the WebOb library, which are used for analyzing HTTP requests and generating HTTP responses, allow a hacker to redirect users to any given URL address.

The vulnerability of the urlparse and urljoin functions in the WebOb library, which are used for analyzing HTTP requests and generating HTTP responses, relates to the redirection of URLs to unreliable websites when processing the HTTP Location header. Exploiting this vulnerability allows a remote...

webob: WebOb's location header normalization during redirect leads to open redirect

A vulnerability was found in the WebOb package. WebOb normalizes the HTTP Location header using urlparse and urljoin. If the URL starts with //, urlparse treats the following part as the hostname, and replaces the original request's hostname. This issue, combined with user interaction, may become...

RHSA-2024:6775 Red Hat Security Advisory: Red Hat OpenStack Platform 18.0 (python-webob) security update

Bulletin has no description...

webob: WebOb's location header normalization during redirect leads to open redirect

A vulnerability was found in the WebOb package. WebOb normalizes the HTTP Location header using urlparse and urljoin. If the URL starts with //, urlparse treats the following part as the hostname, and replaces the original request's hostname. This issue, combined with user interaction, may become...

webob: WebOb's location header normalization during redirect leads to open redirect

A vulnerability was found in the WebOb package. WebOb normalizes the HTTP Location header using urlparse and urljoin. If the URL starts with //, urlparse treats the following part as the hostname, and replaces the original request's hostname. This issue, combined with user interaction, may become...

webob: WebOb's location header normalization during redirect leads to open redirect

A vulnerability was found in the WebOb package. WebOb normalizes the HTTP Location header using urlparse and urljoin. If the URL starts with //, urlparse treats the following part as the hostname, and replaces the original request's hostname. This issue, combined with user interaction, may become...

Moderate: Red Hat Security Advisory: Red Hat OpenStack Platform 18.0 (python-webob) security update

An update for python-webob is now available for Red Hat OpenStack Platform 18.0 Wallaby. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

RHEL 9 : Red Hat OpenStack Platform 18.0 (python-webob) (RHSA-2024:6775)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:6775 advisory. WebOb provides wrappers around the WSGI request environment, and an object to help create WSGI responses. The objects map much of the specified...

Updated python3-webob package fix security vulnerability

When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. urlparse however treats a // at the start of a string as a URI without a scheme, and then trea...

MGASA-2024-0308 Updated python3-webob package fix security vulnerability

When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. urlparse however treats a // at the start of a string as a URI without a scheme, and then trea...

Mageia: Security Advisory (MGASA-2024-0308)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

WebOb's location header normalization during redirect leads to open redirect

...

openSUSE Security Advisory (SUSE-SU-2024:3116-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-WebOb (SUSE-SU-2024:3116-1)

The remote SUSE Linux SLED15 / SLEDSAP15 / SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:3116-1 advisory. - CVE-2024-42353: Fixed open redirect via WebOb's Response object in Location header bsc1229221 Tenable h...

SUSE: Security Advisory (SUSE-SU-2024:3116-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:3116-1 Security update for python-WebOb

This update for python-WebOb fixes the following issues: - CVE-2024-42353: Fixed open redirect via WebOb's Response object in Location header bsc1229221...

Ubuntu: Security Advisory (USN-6984-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

USN-6984-1: WebOb vulnerability

It was discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this issue to control a redirect or forward to another URL...

USN-6984-1 python-webob vulnerability

It was discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this issue to control a redirect or forward to another URL...

Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS : WebOb vulnerability (USN-6984-1)

The remote Ubuntu 20.04 LTS / 22.04 LTS / 24.04 LTS host has a package installed that is affected by a vulnerability as referenced in the USN-6984-1 advisory. It was discovered that WebOb incorrectly handled certain URLs. An attacker could possibly use this issue to control a redirect or forward ...