vulntracker.iovulntracker.io
© 2026 vulntracker.io

CVE-2023-24329

HIGH
7.5
CVSS Score
Published: February 17, 2023 at 12:00 AM UTC
Updated: October 14, 2026 at 11:17 PM UTC
6 products affected across 3 vendorsFedoraActive IQ Unified ManagerPython

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available
Start FreeSign In
Severity
HIGH7.5
Exploit prediction
EPSS 20%
SSVC
No known exploit

Description

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Fedora· Fedora Projectrpm
95%
363738
Active IQ Unified Manager· NetAppnpm
95%
All versions
Management Services for Element Software· NetApp
95%
All versions
Management Services for NetApp Hci· NetApp
95%
All versions
ONTAP Select Deploy administration utility· NetApp
95%
All versions
Python· Python
95%
All versionsv < 3.7.173.10.0 ≤ v < 3.10.123.11.0 ≤ v < 3.11.43.8.0 ≤ v < 3.8.173.9.0 ≤ v < 3.9.17
Affected range stops below 3.10.12, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.11.4, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.7.17, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.8.17, so it looks safe — our inference, not a vendor statement
Affected range stops below 3.9.17, so it looks safe — our inference, not a vendor statement

References (30)

Issue Tracking
Source: [email protected]
https://github.com/python/cpython/issues/102153
Patch
Source: [email protected]
https://github.com/python/cpython/pull/99421
Mailing List
Source: [email protected]
https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
Vendor Advisory
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/
Vendor Advisory
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/
Vendor Advisory
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/
Vendor Advisory
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/
Vendor Advisory
Source: [email protected]
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/

SSVC — Action Prioritization

SSVCNo known exploitAutomatablePartial impact

SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.

CVSS

7.5HIGHCISA-ADP
Attack Vector
NETWORK
Complexity
LOW
Privileges
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
NONE
Integrity
HIGH
Availability
NONE
Vector?

Quick Info

StatusMODIFIED
CWE
CWE-20

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create accountSign in
Free plan, no card