CVE catalog

CVE-2024-42353

WebOb vulnerability

[CVE catalog]

Severity
Medium · CVSS 6.1CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Published
Source
[NVD] · [CVE record]
EPSS
0.57% · Oct 25, 2026

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianpython-webobsid1:1.8.11-1fixed
Debianpython-webobforky1:1.8.11-1fixed
Debianpython-webobtrixie1:1.8.10-0+deb13u1fixed
Debianpython-webobbookworm1:1.8.6-3vulnerable
Ubuntupython-webobnobleNot reportedvulnerable
Ubuntupython-webobnoble1:1.8.7-1ubuntu0.1.24.04.1fixed
Ubuntupython-webob-docnoble1:1.8.7-1ubuntu0.1.24.04.1fixed
Ubuntupython3-webobnoble1:1.8.7-1ubuntu0.1.24.04.1fixed
Ubuntupython-webobnoble1:1.8.7-1ubuntu0.1.24.04.2fixed
Ubuntupython-webob-docnoble1:1.8.7-1ubuntu0.1.24.04.2fixed
Ubuntupython3-webobnoble1:1.8.7-1ubuntu0.1.24.04.2fixed
Ubuntupython-webobpro1:1.8.5-1vulnerable
Ubuntupython-webobpro1:1.8.5-1build1vulnerable
Ubuntupython-webobpro1:1.8.5-2vulnerable
Ubuntupython-webobpro1:1.8.5-2ubuntu0.1vulnerable
Ubuntupython-webobpro1:1.8.5-2ubuntu0.1+esm1fixed
Ubuntupython-webob22.041:1.8.6-1.1vulnerable
Ubuntupython-webob22.041:1.8.6-1.1ubuntu0.1vulnerable
Ubuntupython-webob22.041:1.8.6-1.1ubuntu0.2fixed
Ubuntupython-webob24.041:1.8.6-3vulnerable
Ubuntupython-webob24.041:1.8.7-1vulnerable
Ubuntupython-webob24.041:1.8.7-1ubuntu0.1.24.04.1vulnerable
Ubuntupython-webob24.041:1.8.7-1ubuntu0.1.24.04.2fixed
Ubuntupython-webob26.041:1.8.9-1vulnerable
Ubuntupython-webob26.041:1.8.9-1ubuntu0.1fixed
Ubuntupython-webobpro1:1.7.2-0ubuntu1vulnerable
Ubuntupython-webobpro1:1.7.3-0ubuntu1vulnerable
Ubuntupython-webobpro1:1.7.3-2fakesync1vulnerable
Ubuntupython-webobpro1:1.7.3-2ubuntu0.1~esm2fixed
Ubuntupython-webob20.041:1.8.5-1vulnerable
Ubuntupython-webob20.041:1.8.5-1build1vulnerable
Ubuntupython-webob20.041:1.8.5-2vulnerable
Ubuntupython-webob20.041:1.8.5-2ubuntu0.1fixed
Ubuntupython-webob22.041:1.8.6-1.1vulnerable
Ubuntupython-webob22.041:1.8.6-1.1ubuntu0.1fixed
Ubuntupython-webob24.041:1.8.6-3vulnerable
Ubuntupython-webob24.041:1.8.7-1vulnerable
Ubuntupython-webob24.041:1.8.7-1ubuntu0.1.24.04.1fixed
Ubuntupython-webob20.041:1.8.5-1vulnerable
Ubuntupython-webob20.041:1.8.5-1build1vulnerable
Ubuntupython-webob20.041:1.8.5-2vulnerable
Ubuntupython-webob20.041:1.8.5-2ubuntu0.1fixed
Ubuntupython-webob22.041:1.8.6-1.1vulnerable
Ubuntupython-webob22.041:1.8.6-1.1ubuntu0.1fixed
Ubuntupython-webob24.041:1.8.6-3vulnerable
Ubuntupython-webob24.041:1.8.7-1vulnerable
Ubuntupython-webob24.041:1.8.7-1ubuntu0.1.24.04.1fixed
Opensusepython-WebObtumbleweed1.8.8-1.1fixed
Susepython-WebOblinux enterprise module for public cloud 121.2.3-3.3.1fixed
Susepython-WebOblinux enterprise module for basesystem 15 sp51.7.4-150000.3.3.1fixed
Susepython-WebOblinux enterprise module for basesystem 15 sp61.7.4-150000.3.3.1fixed
Susepython-WebOblinux enterprise module for package hub 15 sp51.7.4-150000.3.3.1fixed
Susepython-WebOblinux enterprise module for package hub 15 sp61.7.4-150000.3.3.1fixed
Opensusepython-WebObleap 15.51.7.4-150000.3.3.1fixed
Opensusepython-WebObleap 15.61.8.7-150400.11.6.1fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianpython-webobsourcesid1:1.8.9-1not yet assignedNot reported[1078879]
Debianpython-webobsourceforky1:1.8.9-1not yet assignedNot reported[1078879]
Debianpython-webobsourcetrixie1:1.8.9-1not yet assignedNot reported[1078879]
Debianpython-webobsourcebookworm(unfixed)not yet assignedNot reported[1078879]
Ubuntupython-webobdebnoble1:1.8.7-1ubuntu0.1.24.04.1Not reportedNot reportedNot reported
Ubuntupython-webob-docdebnoble1:1.8.7-1ubuntu0.1.24.04.1Not reportedNot reportedNot reported
Ubuntupython3-webobdebnoble1:1.8.7-1ubuntu0.1.24.04.1Not reportedNot reportedNot reported
Ubuntupython-webobdebnoble1:1.8.7-1ubuntu0.1.24.04.2Not reportedNot reportedNot reported
Ubuntupython-webob-docdebnoble1:1.8.7-1ubuntu0.1.24.04.2Not reportedNot reportedNot reported
Ubuntupython3-webobdebnoble1:1.8.7-1ubuntu0.1.24.04.2Not reportedNot reportedNot reported
Ubuntupython-webobdebpro1:1.8.5-2ubuntu0.1+esm1Not reportedUSN-8759-1Not reported
Ubuntupython-webobdeb22.041:1.8.6-1.1ubuntu0.2Not reportedUSN-8759-1Not reported
Ubuntupython-webobdeb24.041:1.8.7-1ubuntu0.1.24.04.2Not reportedUSN-8759-1Not reported
Ubuntupython-webobdeb26.041:1.8.9-1ubuntu0.1Not reportedUSN-8759-1Not reported
Ubuntupython-webobdebpro1:1.7.3-2ubuntu0.1~esm2Not reportedUBUNTU-CVE-2024-42353Not reported
Ubuntupython-webobdeb20.041:1.8.5-2ubuntu0.1Not reportedUBUNTU-CVE-2024-42353Not reported
Ubuntupython-webobdeb22.041:1.8.6-1.1ubuntu0.1Not reportedUBUNTU-CVE-2024-42353Not reported
Ubuntupython-webobdeb24.041:1.8.7-1ubuntu0.1.24.04.1Not reportedUBUNTU-CVE-2024-42353Not reported
Ubuntupython-webobdeb20.041:1.8.5-2ubuntu0.1Not reportedUSN-6984-1Not reported
Ubuntupython-webobdeb22.041:1.8.6-1.1ubuntu0.1Not reportedUSN-6984-1Not reported
Ubuntupython-webobdeb24.041:1.8.7-1ubuntu0.1.24.04.1Not reportedUSN-6984-1Not reported
Opensusepython-WebObrpmtumbleweed1.8.8-1.1Not reportedOPENSUSE-SU-2024:14279-1Not reported
Susepython-WebObrpmlinux enterprise module for public cloud 121.2.3-3.3.1Not reportedSUSE-SU-2024:2969-1Not reported
Susepython-WebObrpmlinux enterprise module for basesystem 15 sp51.7.4-150000.3.3.1Not reportedSUSE-SU-2024:3116-1Not reported
Susepython-WebObrpmlinux enterprise module for basesystem 15 sp61.7.4-150000.3.3.1Not reportedSUSE-SU-2024:3116-1Not reported
Susepython-WebObrpmlinux enterprise module for package hub 15 sp51.7.4-150000.3.3.1Not reportedSUSE-SU-2024:3116-1Not reported
Susepython-WebObrpmlinux enterprise module for package hub 15 sp61.7.4-150000.3.3.1Not reportedSUSE-SU-2024:3116-1Not reported
Opensusepython-WebObrpmleap 15.51.7.4-150000.3.3.1Not reportedSUSE-SU-2024:3116-1Not reported
Opensusepython-WebObrpmleap 15.61.8.7-150400.11.6.1Not reportedSUSE-SU-2024:2970-1Not reported

[Debian bug #1078879]

Notes

[bookworm] python-webob: Minor issue

OpenFactory catalog packages

[Debian 12 (Bookworm)]

  • [python3-webob]Affected

    Source package: [python-webob]

    Details (2)

    • 1:1.8.6-3 · all · bookworm

      Affected

      usn · python-webob · debian · bookworm; usn · python-webob · debian · 12

    • 1:1.8.6-3 · all · bookworm

      Affected

      usn · python-webob · debian · bookworm; usn · python-webob · debian · 12

  • [python-webob-doc]Affected

    Source package: [python-webob]

    Details (2)

    • 1:1.8.6-3 · all · bookworm

      Affected

      usn · python-webob · debian · bookworm; usn · python-webob · debian · 12

    • 1:1.8.6-3 · all · bookworm

      Affected

      usn · python-webob · debian · bookworm; usn · python-webob · debian · 12

[openSUSE Tumbleweed]

  • [python313-WebOb]Unknown

    Source package: [python-WebOb]

    Details (1)

    • 1.8.10-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.8.8-1.1

      Version impact unknown

      usn · python-WebOb · opensuse · tumbleweed

  • [python314-WebOb]Unknown

    Source package: [python-WebOb]

    Details (1)

    • 1.8.10-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.8.8-1.1

      Version impact unknown

      usn · python-WebOb · opensuse · tumbleweed

  • [python-WebOb-doc]Unknown

    Source package: [python-WebOb]

    Details (1)

    • 1.8.10-1.3 · noarch · tumbleweed

      Unknown · Fixed: 1.8.8-1.1

      Version impact unknown

      usn · python-WebOb · opensuse · tumbleweed

[Debian 13 (Trixie)]

  • [python3-webob]Fixed

    Source package: [python-webob]

    Details (2)

    • 1:1.8.10-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:1.8.9-1

      usn · python-webob · debian · 13

    • 1:1.8.10-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:1.8.9-1

      usn · python-webob · debian · 13

  • [python-webob-doc]Fixed

    Source package: [python-webob]

    Details (2)

    • 1:1.8.10-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:1.8.9-1

      usn · python-webob · debian · 13

    • 1:1.8.10-0+deb13u1 · all · trixie

      Fixed · Fixed: 1:1.8.9-1

      usn · python-webob · debian · 13

Observed:

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX] · [Ubuntu Security Notices (USN)]