https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 04 Oct 2026 15:17:04 +0000 https://cve.radiocsirt.org/vuln/cve-2026-44889 <p><strong>Affected:</strong> Pylons webob</p> <p>WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python&#39;s urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.</p> <p><strong>Affected:</strong> Pylons webob</p> <p>WebOb provides objects for HTTP requests and responses. Prior to 1.8.10, the normalization of the HTTP Location header during a redirect is vulnerable to an open redirect: WebOb joins the redirect target to the request URI using Python&#39;s urljoin, and since Python 3.10 the underlying urlsplit strips ASCII tab, carriage return, and newline characters before parsing, so a redirect target containing such characters can be reinterpreted as a protocol-relative URL whose authority is an attacker-controlled host. This bypasses the CVE-2024-42353 fix that escaped a leading double slash, allowing an attacker who influences the redirect location to send users to an arbitrary external site instead of the intended one. This vulnerability is fixed in 1.8.10.</p> https://cve.radiocsirt.org/vuln/cve-2026-44889 https://cve.radiocsirt.org/vuln/ghsa-fh3h-vg37-cc95 <p><strong>Affected:</strong> PyPI: webob</p> <p>### Impact</p> <p>When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python&#39;s `urllib.parse`, and joining it to the base URL. `urlsplit` (called internally by `urljoin`) however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request.</p> <p>In a previous advisory https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3 an attempt to fix this was made by forcing the replacement of `//` with `/%2f`, however this did not take into account that since Python 3.10 `urlsplit` internally strips ASCII tab, carriage return, and newline characters from the string, so `/\t/attacker.com` gets turned into `//attacker.com` and the attacker is able to bypass the changes introduced in that previous advisory, thereby bringing back the problem that was attempted to be fixed.</p> <p>``` &gt;&gt;&gt; parse.urlparse(&#34;//attacker.com/some/path&#34;) ParseResult(scheme=&#39;&#39;, netloc=&#39;attacker.com&#39;, path=&#39;/some/path&#39;, params=&#39;&#39;, query=&#39;&#39;, fragment=&#39;&#39;) ```</p> <p>WebOb uses `urljoin` to take the request URI and join the redirect location to it, so assuming the request URI is `https://example.org/` and the URL to redirect to is `/\t/attacker.com/some/path/`:</p> <p>``` &gt;&gt;&gt; parse.urljoin(&#34;https://example.org/&#34;, &#34;/\t/attacker.com/some/path/&#34;) &#39;https://attacker.c…</p> <p><strong>Affected:</strong> PyPI: webob</p> <p>### Impact</p> <p>When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python&#39;s `urllib.parse`, and joining it to the base URL. `urlsplit` (called internally by `urljoin`) however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request.</p> <p>In a previous advisory https://github.com/Pylons/webob/security/advisories/GHSA-mg3v-6m49-jhp3 an attempt to fix this was made by forcing the replacement of `//` with `/%2f`, however this did not take into account that since Python 3.10 `urlsplit` internally strips ASCII tab, carriage return, and newline characters from the string, so `/\t/attacker.com` gets turned into `//attacker.com` and the attacker is able to bypass the changes introduced in that previous advisory, thereby bringing back the problem that was attempted to be fixed.</p> <p>``` &gt;&gt;&gt; parse.urlparse(&#34;//attacker.com/some/path&#34;) ParseResult(scheme=&#39;&#39;, netloc=&#39;attacker.com&#39;, path=&#39;/some/path&#39;, params=&#39;&#39;, query=&#39;&#39;, fragment=&#39;&#39;) ```</p> <p>WebOb uses `urljoin` to take the request URI and join the redirect location to it, so assuming the request URI is `https://example.org/` and the URL to redirect to is `/\t/attacker.com/some/path/`:</p> <p>``` &gt;&gt;&gt; parse.urljoin(&#34;https://example.org/&#34;, &#34;/\t/attacker.com/some/path/&#34;) &#39;https://attacker.c…</p> https://cve.radiocsirt.org/vuln/ghsa-fh3h-vg37-cc95