An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
CC324629-0240-4DC0-BAFA-D476D5FDDA61
3.7.17
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
0A6B1607-9E1F-4A14-918F-B1A1786D028E
3.8.17
3.8.0
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
0287FC5A-256F-40EE-93D0-2DFFE38BB5A1
3.9.17
3.9.0
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
4AA7FA11-C746-4E69-94C2-18E745D82054
3.10.12
3.10.0
cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
AD14A157-FEA9-411F-B338-F1B6F726599D
3.11.4
3.11.0
OR
cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD
cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
E30D0E6F-4AE8-4284-8716-991DFA48CC5D
cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
CC559B26-5DFC-4B7A-A27C-B77DE755DFF9
OR
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
3A756737-1CC4-42C2-A4DF-E1C893B4E2D5
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
B55E8D50-99B4-47EC-86F9-699B67D473CE
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
86B51137-28D9-41F2-AFA2-3CC22B4954D1
cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*
4455CF3A-CC91-4BE4-A7AB-929AC82E34F5
cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
E7CF3019-975D-40BB-A8A4-894E62BD3797
OR
Everyone (including the [submitter](https://pointernull.com/security/python-url-parse-problem.html) of the now public exploit who submitted the issue half a year ago to `security@python.org` and the [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-24329)) seems to think that #99421 "accidently fixed" CVE-2023-24329.

Did the Python Security Response Team verify that this vulnerability that was reported to them and that is now public was fixed by #99421?

The PoC from the submitter still works for me with the Debian package 3.11.2-4, which surprised me and makes me wonder whether the fix had any effect at all on the stripping of leading blanks issue in the CVE.

<!-- gh-linked-prs -->
### Linked PRs
* gh-102470
* gh-102508
* gh-104575
* gh-104592
* gh-104593
* gh-104895
* gh-104896
* gh-104918
<!-- /gh-linked-prs -->

urllib.parse space handling CVE-2023-24329 appears unfixed
This is a GitHub Issue
repo:cpython
owner:python
Title : urllib.parse space handling CVE-2023-24329 appears unfixed
Issue date:

--- start body ---
Everyone (including the [submitter](https://pointernull.com/security/python-url-parse-problem.html) of the now public exploit who submitted the issue half a year ago to `security@python.org` and the [NVD](https://nvd.nist.gov/vuln/detail/CVE-2023-24329)) seems to think that #99421 "accidently fixed" CVE-2023-24329.

Did the Python Security Response Team verify that this vulnerability that was reported to them and that is now public was fixed by #99421?

The PoC from the submitter still works for me with the Debian package 3.11.2-4, which surprised me and makes me wonder whether the fix had any effect at all on the stripping of leading blanks issue in the CVE.

<!-- gh-linked-prs -->
### Linked PRs
* gh-102470
* gh-102508
* gh-104575
* gh-104592
* gh-104593
* gh-104895
* gh-104896
* gh-104918
<!-- /gh-linked-prs -->

--- end body ---

comments :
--- start comments ---

--- end comments ---