Skip to content
Fencer Vulns
high 7.5

CVE-2023-24329 in the critical feed json

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that star…

published 2023-02-17 3 y ago modified 2026-10-14 25 d ago also BIT-libpython-2023-24329 , BIT-python-2023-24329 , BIT-python-min-2023-24329 , EUVD-2023-28385

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
20.5%
EPSS 20.5% chance of exploitation in 30 days, percentile 97%
public exploits
0
none known

Summary

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Patch / fix

  • bitnami libpython 3.7.17, 3.8.17, 3.9.17, 3.10.12, 3.11.4
  • bitnami python 3.7.17, 3.8.17, 3.9.17, 3.10.12, 3.11.4
  • bitnami python-min 3.7.17, 3.8.17, 3.9.17, 3.10.12, 3.11.4
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • pypy3 Debian 12 7.3.11+dfsg-2+deb12u2
  • pypy3 Debian 14, Debian 13 7.3.12+dfsg-1
  • python3.11 Debian 12 3.11.2-6+deb12u2

debian advisories DEBIAN-CVE-2023-24329

  • python2.7 Ubuntu 20.04 LTS 2.7.18-1~20.04.7
  • python2.7 Ubuntu 22.04 LTS 2.7.18-13ubuntu1.5
  • python3.8 Ubuntu 20.04 LTS 3.8.10-0ubuntu1~20.04.8
  • python3.10 Ubuntu 22.04 LTS 3.10.6-1~22.04.2ubuntu1.1
  • python2.7 Ubuntu Pro 14.04 LTS 2.7.6-8ubuntu0.6+esm15
  • python2.7 Ubuntu Pro 16.04 LTS 2.7.12-1ubuntu0~16.04.18+esm5
  • python2.7 Ubuntu Pro 18.04 LTS 2.7.17-1~18.04ubuntu1.13
  • python3.5 Ubuntu Pro 14.04 LTS 3.5.2-2ubuntu0~16.04.4~14.04.1+esm1

ubuntu advisories UBUNTU-CVE-2023-24329

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • rh-python38-python RHEL 3 SOFTWARE_COLLECTIONS 3.8.18-2.el7
  • rh-python38-python-pip RHEL 3 SOFTWARE_COLLECTIONS 19.3.1-4.el7
  • rh-python38-python-idle RHEL 3 SOFTWARE_COLLECTIONS 3.8.18-2.el7
  • rh-python38-python-libs RHEL 3 SOFTWARE_COLLECTIONS 3.8.18-2.el7
  • rh-python38-python-test RHEL 3 SOFTWARE_COLLECTIONS 3.8.18-2.el7
  • rh-python38-python-wheel RHEL 3 SOFTWARE_COLLECTIONS 0.33.6-9.el7
  • rh-python38-python-tkinter RHEL 3 SOFTWARE_COLLECTIONS 3.8.18-2.el7
  • rh-python38-python-requests RHEL 3 SOFTWARE_COLLECTIONS 2.22.0-11.el7

red hat advisories RHSA-2023:6793RHSA-2023:4282RHSA-2023:4032RHSA-2023:4203RHSA-2023:3932RHSA-2023:3934

  • python39 SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +7 more 3.9.17-150300.4.30.1
  • python39-core SLES for SAP 15 SP3, SLES 15 SP3-LTSS, SLE Real Time 15 SP3 +7 more 3.9.17-150300.4.30.1
  • python39-documentation openSUSE Leap 15.5, openSUSE Leap 15.4 3.9.17-150300.4.30.1
  • python311 SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 3.11.4-150400.9.15.1
  • python311-core SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 3.11.4-150400.9.15.3
  • python311-documentation SLE Module for Python 3 15 SP5, SLE Module for Python 3 15 SP4, openSUSE Leap 15.5 +1 more 3.11.4-150400.9.15.2
  • python310 SLE Module for Python 3 15 SP4, openSUSE Leap 15.5, openSUSE Leap 15.4 3.10.12-150400.4.30.1
  • python310-core SLE Module for Python 3 15 SP4, openSUSE Leap 15.5, openSUSE Leap 15.4 3.10.12-150400.4.30.1

suse advisories SUSE-SU-2023:2957-1SUSE-SU-2023:2937-1SUSE-SU-2023:2884-1SUSE-SU-2023:2639-1SUSE-SU-2023:0868-2SUSE-SU-2023:0868-1

  • python-yarl openSUSE Tumbleweed 1.24.5-1.1
  • python315 openSUSE Tumbleweed 3.15.0~a1-1.1
  • python314 openSUSE Tumbleweed 3.14.0~a1-1.1
  • python313 openSUSE Tumbleweed 3.13.0~b3-1.1
  • python openSUSE Tumbleweed 2.7.18-29.1
  • python-yarl openSUSE Tumbleweed 1.8.2-3.1
  • python38 openSUSE Tumbleweed 3.8.16-5.1
  • python39 openSUSE Tumbleweed 3.9.16-5.1

opensuse advisories openSUSE-SU-2026:11589-1openSUSE-SU-2025:15713-1openSUSE-SU-2024:14434-1openSUSE-SU-2024:14109-1openSUSE-SU-2024:12741-1openSUSE-SU-2024:12742-1

  • python39 AlmaLinux 8 3.9.16-1.module_el8.8.0+3577+f4afbb0e.1
  • python39-py AlmaLinux 8 1.10.0-1.module_el8.6.0+2780+a40f65e1
  • python39-pip AlmaLinux 8 20.2.4-7.module_el8.6.0+2780+a40f65e1
  • python39-ply AlmaLinux 8 3.11-10.module_el8.6.0+2780+a40f65e1
  • python39-six AlmaLinux 8 1.15.0-3.module_el8.6.0+2780+a40f65e1
  • python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+2780+a40f65e1
  • python39-cffi AlmaLinux 8 1.14.3-2.module_el8.6.0+3248+c431e88c
  • python39-idle AlmaLinux 8 3.9.16-1.module_el8.8.0+3577+f4afbb0e.1

almalinux advisories ALSA-2023:3811ALSA-2023:3780ALSA-2023:3781ALSA-2023:3585ALSA-2023:3591ALSA-2023:3594

  • python3.11 Rocky Linux 9 3.11.2-2.el9_2.1
  • python3.9 Rocky Linux 9 3.9.16-1.el9_2.1
  • python3.11 Rocky Linux 8 3.11.2-2.el8_8.1
  • pytz Rocky Linux 8 2019.3-3.module+el8.4.0+570+c2eaf144
  • babel Rocky Linux 8 2.7.0-11.module+el8.5.0+672+ab6eb015
  • numpy Rocky Linux 8 1.17.3-6.module+el8.5.0+672+ab6eb015
  • scipy Rocky Linux 8 1.3.1-4.module+el8.5.0+672+ab6eb015
  • Cython Rocky Linux 8 0.29.14-4.module+el8.4.0+570+c2eaf144

rocky linux advisories RLSA-2023:3585RLSA-2023:3595RLSA-2023:3594RLSA-2023:3781RLSA-2023:3811RLSA-2023:3780

  • python3 CBL-Mariner 2.0 3.9.14-8

azure linux advisories AZL-31165

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-24329 updated cvss 7.5

python: urllib.parse url blocklisting bypass

  • Red Hat Enterprise Linux 8 python2, python2-libs, python2-test, python2-tools, python2-tkinter
    affected: no fix available
  • Red Hat CodeReady Linux Builder EUS (v.8.6) pytest 4.6.6-3.module+el8.4.0+8888+89bc7e79, pytest 6.0.2-2.module+el8.4.0+9822+20bf1249, Cython 0.29.21-5.module+el8.4.0+9822+20bf1249, pybind11 2.7.1-1.module+el8.6.0+12838+640e6226, python-py 1.8.0-8.module+el8.4.0+8888+89bc7e79, python-py 1.10.0-1.module+el8.4.0+9822+20bf1249, +34 more
    fixed: vendor fix RHSA-2023:4032
  • Red Hat CodeReady Linux Builder EUS (v.9.0) python3 3.9.10-4.el9_0.1, python3-idle 3.9.10-4.el9_0.1, python3-test 3.9.10-4.el9_0.1, python3-tkinter 3.9.10-4.el9_0.1
    fixed: vendor fix RHSA-2023:4203
  • Red Hat Enterprise Linux AppStream (v. 8) python3.11 3.11.2-2.el8_8.1, python3-idle 3.6.8-51.el8_8.1, python3-test 3.6.8-51.el8_8.1, platform-python 3.6.8-51.el8_8.1, python3-tkinter 3.6.8-51.el8_8.1, python3.11-libs 3.11.2-2.el8_8.1, +211 more
    fixed: vendor fix RHSA-2023:3780
  • Red Hat Enterprise Linux AppStream (v. 9) python3.11 3.11.2-2.el9_2.1, python3-tkinter 3.9.16-1.el9_2.1, python3.11-libs 3.11.2-2.el9_2.1, python3.11-tkinter 3.11.2-2.el9_2.1, python-unversioned-command 3.9.16-1.el9_2.1
    fixed: vendor fix RHSA-2023:3595
  • Red Hat Enterprise Linux AppStream AUS (v. 8.2) python3-idle 3.6.8-24.el8_2.1, python3-test 3.6.8-24.el8_2.1, platform-python 3.6.8-24.el8_2.1, python3-tkinter 3.6.8-24.el8_2.1, babel 2.5.1-9.module+el8.1.0+3111+de3f2d8e, pytz 2019.3-3.module+el8.2.0+5234+f98739b6, +153 more
    fixed: vendor fix RHSA-2023:3777
  • Red Hat Enterprise Linux AppStream AUS (v.8.4) python3-idle 3.6.8-39.el8_4.2, python3-test 3.6.8-39.el8_4.2, platform-python 3.6.8-39.el8_4.2, python3-tkinter 3.6.8-39.el8_4.2, babel 2.5.1-9.module+el8.1.0+3111+de3f2d8e, pytz 2019.3-3.module+el8.4.0+8888+89bc7e79, +207 more
    fixed: vendor fix RHSA-2023:3931
  • Red Hat Enterprise Linux AppStream E4S (v. 8.1) python3-idle 3.6.8-15.1.el8_1.1, python3-test 3.6.8-15.1.el8_1.1, platform-python 3.6.8-15.1.el8_1.1, python3-tkinter 3.6.8-15.1.el8_1.1, babel 2.5.1-9.module+el8.1.0+3111+de3f2d8e, pytz 2017.2-12.module+el8.1.0+3111+de3f2d8e, +88 more
    fixed: vendor fix RHSA-2023:3932
show 27 more
  • Red Hat Enterprise Linux AppStream E4S (v. 8.2) python3-idle 3.6.8-24.el8_2.1, python3-test 3.6.8-24.el8_2.1, platform-python 3.6.8-24.el8_2.1, python3-tkinter 3.6.8-24.el8_2.1, babel 2.5.1-9.module+el8.1.0+3111+de3f2d8e, pytz 2019.3-3.module+el8.2.0+5234+f98739b6, +153 more
    fixed: vendor fix RHSA-2023:3777
  • Red Hat Enterprise Linux AppStream E4S (v.8.4) python3-idle 3.6.8-39.el8_4.2, python3-test 3.6.8-39.el8_4.2, platform-python 3.6.8-39.el8_4.2, python3-tkinter 3.6.8-39.el8_4.2, babel 2.5.1-9.module+el8.1.0+3111+de3f2d8e, pytz 2019.3-3.module+el8.4.0+8888+89bc7e79, +207 more
    fixed: vendor fix RHSA-2023:3931
  • Red Hat Enterprise Linux AppStream EUS (v.8.6) python3-idle 3.6.8-47.el8_6.1, python3-test 3.6.8-47.el8_6.1, platform-python 3.6.8-47.el8_6.1, python3-tkinter 3.6.8-47.el8_6.1, pytz 2019.3-3.module+el8.4.0+8888+89bc7e79, scipy 1.3.1-4.module+el8.4.0+8888+89bc7e79, +207 more
    fixed: vendor fix RHSA-2023:3810
  • Red Hat Enterprise Linux AppStream EUS (v.9.0) python3-tkinter 3.9.10-4.el9_0.1, python-unversioned-command 3.9.10-4.el9_0.1
    fixed: vendor fix RHSA-2023:4203
  • Red Hat Enterprise Linux AppStream TUS (v. 8.2) python3-idle 3.6.8-24.el8_2.1, python3-test 3.6.8-24.el8_2.1, platform-python 3.6.8-24.el8_2.1, python3-tkinter 3.6.8-24.el8_2.1, babel 2.5.1-9.module+el8.1.0+3111+de3f2d8e, pytz 2019.3-3.module+el8.2.0+5234+f98739b6, +153 more
    fixed: vendor fix RHSA-2023:3777
  • Red Hat Enterprise Linux AppStream TUS (v.8.4) python3-idle 3.6.8-39.el8_4.2, python3-test 3.6.8-39.el8_4.2, platform-python 3.6.8-39.el8_4.2, python3-tkinter 3.6.8-39.el8_4.2, babel 2.5.1-9.module+el8.1.0+3111+de3f2d8e, pytz 2019.3-3.module+el8.4.0+8888+89bc7e79, +207 more
    fixed: vendor fix RHSA-2023:3931
  • Red Hat Enterprise Linux BaseOS (v. 8) python3 3.6.8-51.el8_8.1, python3-libs 3.6.8-51.el8_8.1, python3-test 3.6.8-51.el8_8.1, platform-python 3.6.8-51.el8_8.1
    fixed: vendor fix RHSA-2023:3591
  • Red Hat Enterprise Linux BaseOS (v. 9) python3 3.9.16-1.el9_2.1, python3.9 3.9.16-1.el9_2.1, python3-libs 3.9.16-1.el9_2.1
    fixed: vendor fix RHSA-2023:3595
  • Red Hat Enterprise Linux BaseOS AUS (v. 8.2) python3 3.6.8-24.el8_2.1, python3-libs 3.6.8-24.el8_2.1, python3-test 3.6.8-24.el8_2.1, platform-python 3.6.8-24.el8_2.1
    fixed: vendor fix RHSA-2023:3935
  • Red Hat Enterprise Linux BaseOS AUS (v.8.4) python3 3.6.8-39.el8_4.2, python3-libs 3.6.8-39.el8_4.2, python3-test 3.6.8-39.el8_4.2, platform-python 3.6.8-39.el8_4.2
    fixed: vendor fix RHSA-2023:3934
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.1) python3 3.6.8-15.1.el8_1.1, python3-libs 3.6.8-15.1.el8_1.1, python3-test 3.6.8-15.1.el8_1.1, platform-python 3.6.8-15.1.el8_1.1
    fixed: vendor fix RHSA-2023:3936
  • Red Hat Enterprise Linux BaseOS E4S (v. 8.2) python3 3.6.8-24.el8_2.1, python3-libs 3.6.8-24.el8_2.1, python3-test 3.6.8-24.el8_2.1, platform-python 3.6.8-24.el8_2.1
    fixed: vendor fix RHSA-2023:3935
  • Red Hat Enterprise Linux BaseOS E4S (v.8.4) python3 3.6.8-39.el8_4.2, python3-libs 3.6.8-39.el8_4.2, python3-test 3.6.8-39.el8_4.2, platform-python 3.6.8-39.el8_4.2
    fixed: vendor fix RHSA-2023:3934
  • Red Hat Enterprise Linux BaseOS EUS (v.8.6) python3 3.6.8-47.el8_6.1, python3-libs 3.6.8-47.el8_6.1, python3-test 3.6.8-47.el8_6.1, platform-python 3.6.8-47.el8_6.1
    fixed: vendor fix RHSA-2023:3796
  • Red Hat Enterprise Linux BaseOS EUS (v.9.0) python3 3.9.10-4.el9_0.1, python3.9 3.9.10-4.el9_0.1, python3-libs 3.9.10-4.el9_0.1
    fixed: vendor fix RHSA-2023:4203
  • Red Hat Enterprise Linux BaseOS TUS (v. 8.2) python3 3.6.8-24.el8_2.1, python3-libs 3.6.8-24.el8_2.1, python3-test 3.6.8-24.el8_2.1, platform-python 3.6.8-24.el8_2.1
    fixed: vendor fix RHSA-2023:3935
  • Red Hat Enterprise Linux BaseOS TUS (v.8.4) python3 3.6.8-39.el8_4.2, python3-libs 3.6.8-39.el8_4.2, python3-test 3.6.8-39.el8_4.2, platform-python 3.6.8-39.el8_4.2
    fixed: vendor fix RHSA-2023:3934
  • Red Hat Enterprise Linux Client (v. 7) python 2.7.5-93.el7_9, python3 3.6.8-19.el7_9, python-libs 2.7.5-93.el7_9, python3-libs 3.6.8-19.el7_9 Red Hat Enterprise Linux Client Optional (v. 7) python3 3.6.8-19.el7_9, tkinter 2.7.5-93.el7_9, python-test 2.7.5-93.el7_9, python-tools 2.7.5-93.el7_9, python3-idle 3.6.8-19.el7_9, python3-test 3.6.8-19.el7_9, +1 more Red Hat Enterprise Linux ComputeNode Optional (v. 7) python3 3.6.8-19.el7_9, tkinter 2.7.5-93.el7_9, python-test 2.7.5-93.el7_9, python-tools 2.7.5-93.el7_9, python3-idle 3.6.8-19.el7_9, python3-test 3.6.8-19.el7_9, +1 more
    fixed: vendor fix RHSA-2023:3555
  • Red Hat Enterprise Linux CRB (v. 8) python3.11 3.11.2-2.el8_8.1, python3.11-idle 3.11.2-2.el8_8.1, python3.11-test 3.11.2-2.el8_8.1, python3.11-tkinter 3.11.2-2.el8_8.1, pytest 4.6.6-3.module+el8.4.0+8888+89bc7e79, pytest 6.0.2-2.module+el8.4.0+9822+20bf1249, +38 more
    fixed: vendor fix RHSA-2023:3781
  • Red Hat Enterprise Linux CRB (v. 9) python3 3.9.16-1.el9_2.1, python3.11 3.11.2-2.el9_2.1, python3-idle 3.9.16-1.el9_2.1, python3-test 3.9.16-1.el9_2.1, python3-tkinter 3.9.16-1.el9_2.1, python3.11-idle 3.11.2-2.el9_2.1, +2 more
    fixed: vendor fix RHSA-2023:3595
  • Red Hat Enterprise Linux Server (v. 6 ELS) python 2.6.6-69.el6_10, tkinter 2.6.6-69.el6_10, python-libs 2.6.6-69.el6_10
    fixed: vendor fix RHSA-2023:3550
  • Red Hat Enterprise Linux Server (v. 7) python 2.7.5-93.el7_9, python3 3.6.8-19.el7_9, python-libs 2.7.5-93.el7_9, python3-libs 3.6.8-19.el7_9
    fixed: vendor fix RHSA-2023:3555
  • Red Hat Enterprise Linux Server Optional (v. 6 ELS) tkinter 2.6.6-69.el6_10, python-test 2.6.6-69.el6_10, python-tools 2.6.6-69.el6_10
    fixed: vendor fix RHSA-2023:3550
  • Red Hat Enterprise Linux Server Optional (v. 7) python3 3.6.8-19.el7_9, tkinter 2.7.5-93.el7_9, python-test 2.7.5-93.el7_9, python-tools 2.7.5-93.el7_9, python3-idle 3.6.8-19.el7_9, python3-test 3.6.8-19.el7_9, +1 more Red Hat Enterprise Linux Workstation (v. 7) python 2.7.5-93.el7_9, python3 3.6.8-19.el7_9, python-libs 2.7.5-93.el7_9, python3-libs 3.6.8-19.el7_9 Red Hat Enterprise Linux Workstation Optional (v. 7) python3 3.6.8-19.el7_9, tkinter 2.7.5-93.el7_9, python-test 2.7.5-93.el7_9, python-tools 2.7.5-93.el7_9, python3-idle 3.6.8-19.el7_9, python3-test 3.6.8-19.el7_9, +1 more
    fixed: vendor fix RHSA-2023:3555
  • Red Hat Software Collections for RHEL Workstation(v. 7) rh-python38-python 3.8.18-2.el7, rh-python38-python-idle 3.8.18-2.el7, rh-python38-python-libs 3.8.18-2.el7, rh-python38-python-test 3.8.18-2.el7, rh-python38-python-tkinter 3.8.18-2.el7, rh-python38-python-rpm-macros 3.8.18-2.el7, +1 more Red Hat Software Collections for RHEL(v. 7) rh-python38-python 3.8.18-2.el7, rh-python38-python-idle 3.8.18-2.el7, rh-python38-python-libs 3.8.18-2.el7, rh-python38-python-test 3.8.18-2.el7, rh-python38-python-tkinter 3.8.18-2.el7, rh-python38-python-rpm-macros 3.8.18-2.el7, +1 more
    fixed: vendor fix RHSA-2023:6793
  • Red Hat Virtualization 4 Hypervisor for RHEL 8 redhat-virtualization-host 4.5.3-202307191258_8.6, redhat-virtualization-host-image-update 4.5.3-202307191258_8.6
    fixed: vendor fix RHSA-2023:4282
  • Red Hat Enterprise Linux 8 scipy, python36, python-nose, python-wheel, python3-bson, python3-nose, +19 more
    not affected: vulnerable code not present

3 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 7.5

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

cisa ICSA-25-105-08 updated cvss 6.5

ABB M2M Gateway

  • ABB M2M Gateway >=4.1.2, <=5.0.3, >=5.0.1, <=5.0.3
    affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
19 mo ago

Exploit prediction

20.46% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • pointernull.com https://pointernull.com/security/python-url-parse-problem.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Affected packages

ecosystem package affected fixed in
bitnami libpython
<3.7.17
>=3.8.0, <3.8.17
>=3.9.0, <3.9.17
>=3.10.0, <3.10.12
>=3.11.0, <3.11.4
3.7.17
3.8.17
3.9.17
3.10.12
3.11.4
bitnami python
<3.7.17
>=3.8.0, <3.8.17
>=3.9.0, <3.9.17
>=3.10.0, <3.10.12
>=3.11.0, <3.11.4
3.7.17
3.8.17
3.9.17
3.10.12
3.11.4
bitnami python-min
<3.7.17
>=3.8.0, <3.8.17
>=3.9.0, <3.9.17
>=3.10.0, <3.10.12
>=3.11.0, <3.11.4
3.7.17
3.8.17
3.9.17
3.10.12
3.11.4

Affected products

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-20 Improper Input Validation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.