CVE-2024-42353 WebOb's location header normalization during redirect leads to open redirect

Medium 6.1 Published 14 Aug 2024 Updated 15 Aug 2024

Exploited in the wild: Not known
Fix: Available

What is CVE-2024-42353?

CVE-2024-42353 is a medium-severity vulnerability in Pylons webob, published on 14 Aug 2024.

Official description

WebOb provides objects for HTTP requests and responses. When WebOb normalizes the HTTP Location header to include the request hostname, it does so by parsing the URL that the user is to be redirected to with Python's urlparse, and joining it to the base URL. `urlparse` however treats a `//` at the start of a string as a URI without a scheme, and then treats the next part as the hostname. `urljoin` will then use that hostname from the second part as the hostname replacing the original one from the request. This vulnerability is patched in WebOb version 1.8.8.

Weakness: CWE-601

Which versions are affected by CVE-2024-42353?

3 open source packages ship an affected version, including webob. It affects 1 product.

Package	Affected	Fixed in
`webob` PyPI	All versions	`1.8.8`
`webob` PyPI	All versions	`1.8.8`
`webob` PyPI	All versions	`1.8.8`

Linux distribution packages (16)

`python-webob` Red Hat:openshift_ironic:4.16::el9	All versions	`0:1.8.8-2.el9`
`python3-webob` Red Hat:openshift_ironic:4.16::el9	All versions	`0:1.8.8-2.el9`
`python-webob` Red Hat:openstack:17.1::el8	All versions	`0:1.8.7-2.1.el8ost`
`python3-webob` Red Hat:openstack:17.1::el8	All versions	`0:1.8.7-2.1.el8ost`
`python-webob` Red Hat:openstack:17.1::el9	All versions	`0:1.8.7-2.1.el9ost`
`python3-webob` Red Hat:openstack:17.1::el9	All versions	`0:1.8.7-2.1.el9ost`
`python-webob` Red Hat:openstack:18.0::el9	All versions	`0:1.8.7-3.el9ost`
`python3-webob` Red Hat:openstack:18.0::el9	All versions	`0:1.8.7-3.el9ost`
`python-WebOb` SUSE:Linux Enterprise Module for Basesystem 15 SP5	All versions	`1.7.4-150000.3.3.1`
`python-WebOb` SUSE:Linux Enterprise Module for Basesystem 15 SP6	All versions	`1.7.4-150000.3.3.1`
`python-WebOb` SUSE:Linux Enterprise Module for Package Hub 15 SP5	All versions	`1.7.4-150000.3.3.1`
`python-WebOb` SUSE:Linux Enterprise Module for Package Hub 15 SP6	All versions	`1.7.4-150000.3.3.1`
`python-WebOb` SUSE:Linux Enterprise Module for Public Cloud 12	All versions	`1.2.3-3.3.1`
`python-WebOb` openSUSE:Leap 15.5	All versions	`1.7.4-150000.3.3.1`
`python-WebOb` openSUSE:Leap 15.6	All versions	`1.8.7-150400.11.6.1`
`python-WebOb` openSUSE:Tumbleweed	All versions	`1.8.8-1.1`

Products include Pylonsproject Webob.

How do I fix CVE-2024-42353?

Upgrade webob to 1.8.8 or later.

Is CVE-2024-42353 being exploited?

There is no known exploitation of CVE-2024-42353 in the wild and no public exploit code.

CVE-2026-44889 WebOb: Location header normalization during redirect leads to open redirect Medium 6.1

Sources

Also known as AZL-47820, AZL-47826, DEBIAN-CVE-2024-42353, ECHO-7481-8feb-d02b, GHSA-mg3v-6m49-jhp3, MGASA-2024-0308 and 12 more.