Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
If a hostname was blacklisted, it was possible to bypass the blacklist by requesting the FQDN of the host (e.g. adding . to the end). Impact The main purpose of this library is to block requests to internal/private IPs and these cannot be bypassed using this finding. But if a library user had specifically set certain hostnames as blocked, then an attacker would be able to circumvent that block to cause SSRFs to request those hostnames. Patches Fixed by https://github.com/IncludeSecurity/safeurl-python/pull/6 Credit https://github.com/Sim4n6
Recommended action: Upgrade to 1.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
In SafeURL it is possible to specify a list of domains that should be matched before a request is sent out. The regex used to compare domains did not work as intended. Impact The regex used was: re.match("(?i)^%s" % domain, value) This has two problems, first that only the beginning and not the end of the string is anchored. Second, that a dot in the domain matches any character as part of regex syntax. Therefore, an allowlist of ["victim.com"] could allow the domain "victimacomattacker.com" to be requested. This has lower impact since the usual attacker aim in an SSRF is to request internal resources such as private IP addresses rather than an attacker's own domain. But, in a case where SafeURL had specifically been used to try to limit requests to a particular allowlist, say for example a PDF renderer, the finding would be more severe. Patches Fixed in https://github.com/IncludeSecurity/safeurl-python/pull/5 References Server-side request forgery (SSRF)
Recommended action: Upgrade to 1.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.