CVE-2023-24329

Exp

An issue in the urllib.parse component of Python before 3.11.4 allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters.

Published: 2023-02-17 Last update: 2025-11-03 Assigner: [email protected] Source: [email protected]
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2023-24329 is rated High Exploit Risk (84/100): CVSS High severity, with high exploitation likelihood (EPSS 20.46%, 97th percentile). 1 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +19.01% over the last day, indicating growing attacker interest. Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2023-24329

EDB-ID Source Kind Published Link
— nvd_ref exploit_tag Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2023-24329

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-15 1.44% 20.46% +19.01%
2 2026-04-26 1.08% 1.44% +0.36%
3 2026-04-21 — 1.08% —

Full EPSS history (31 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2023-24329

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.5 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 3.6 [email protected]
7.5 3.1 HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N Click to expand
Attack vector (AV:N)
Could be attacked over the internet or any normal routed network—not just someone sitting at the machine.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:N)
No account or special rights needed—anonymous or random user is enough.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:N)
Doesn’t really leak secrets in a meaningful way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:N)
Service keeps running; no real outage angle.
 3.9 3.6 134c704f-9b21-4f2e-91b3-4a467353bcc0

Weakness enumeration for CVE-2023-24329

OS Trackers for CVE-2023-24329

vendor priority summary link
debian not yet assigned CVE-2023-24329 not yet assigned priority: Debian including 4 source packages (pypy3, python2.7, python3.11, python3.9), 8 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 8. https://security-tracker.debian.org/tracker/CVE-2023-24329
gentoo high CVE-2023-24329: 1 GLSA(s) (202405-01), 4 atom(s) (dev-lang/python, dev-python/pypy3, dev-python/pypy3_10, dev-python/pypy3_9); latest impact high. https://bugs.gentoo.org/buglist.cgi?quicksearch=CVE-2023-24329
redhat high — https://access.redhat.com/security/cve/CVE-2023-24329
suse high CVE-2023-24329 severity important: SUSE including 844 source package names (0.0.17-1.1:libpython3_6m1_0-3.6.15-150300.10.45.1, 0.0.17-1.1:python3-3.6.15-150300.10.45.1, …), 3022 product×package rows across 420 product lines (Container bci/bci-base-fips, Container bci/bci-sle15-kernel-module-devel, … (420 product lines)): Fixed 2880, Known Affected 142. https://www.suse.com/security/cve/CVE-2023-24329/
ubuntu medium CVE-2023-24329 medium priority: Ubuntu including 9 source packages (python2.7, python3.10, …), 81 status rows across 13 suites (bionic, focal, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 52, released 16, needs-triage 8, ignored 2, not-affected 2, needed 1. https://ubuntu.com/security/CVE-2023-24329

Affected software / configurations for CVE-2023-24329

Vendor Product Version Raw CPE
python python < 3.7.17 cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python python >= 3.8.0, < 3.8.17 cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python python >= 3.9.0, < 3.9.17 cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python python >= 3.10.0, < 3.10.12 cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
python python >= 3.11.0, < 3.11.4 cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
fedoraproject fedora 36 cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*
fedoraproject fedora 37 cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*
fedoraproject fedora 38 cpe:2.3:o:fedoraproject:fedora:38:*:*:*:*:*:*:*
netapp active_iq_unified_manager — cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:*
netapp active_iq_unified_manager — cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
netapp management_services_for_element_software — cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
netapp management_services_for_netapp_hci — cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*
netapp ontap_select_deploy_administration_utility — cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*

References for CVE-2023-24329

URL Tags
https://github.com/python/cpython/issues/102153 Issue Tracking
https://github.com/python/cpython/pull/99421 Patch
https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6PEVICI7YNGGMSL3UCMWGE66QFLATH72/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DSL6NSOAXWBJJ67XPLSSC74MNKZF3BBO/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/EM2XLZSTXG44TMFXF4E6VTGKR2MQCW3G/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/F2NY75GFDZ5T6YPN44D3VMFT5SUVTOTG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GR5US3BYILYJ4SKBV6YBNPRUBAL5P2CN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H23OSKC6UG6IWOQAUPW74YUHWRWVXJP7/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JZTLGV2HYFF4AMYJL25VDIGAIHCU7UPA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LWC4WGXER5P6Q75RFGL7QUTPP3N5JR7T/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MZEHSXSCMA4WWQKXT6QV7AAR6SWNZ2VP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/O5SP4RT3RRS434ZS2HQKQJ3VZW7YPKYR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OHHJHJRLEF3TDT2K3676CAUVRDD4CCMR/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PEUN6T22UJFXR7J5F6UUHCXXPKJ2DVHI/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PURM5CFDABEWAIWZFD2MQ7ZJGCPYSQ44/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/Q3J5N24ECS4B6MJDRO6UAYU6GPLYBDCL/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRQHN7RWJQJHYP6E5EKESOYP5VDSHZG4/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RA2MBEEES6L46OD64OBSVUUMGKNGMOWW/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T4IDB5OAR5Y4UK3HLMZBW4WEL2B7YFMJ/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TZH26JGNZ5XYPZ5SAU3NKSBSPRE5OHTG/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/U2MZOJYGFCB5PPT6AKMAU72N7QOYWLBP/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/UONZWLB4QVLQIY5CPDLEUEKH6WX4VQMC/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WTOAUJNDWZDRWVSXJ354AYZYKRMT56HU/
https://pointernull.com/security/python-url-parse-problem.html Exploit Mitigation Technical Description Third Party Advisory
https://security.netapp.com/advisory/ntap-20230324-0004/ Third Party Advisory
https://www.kb.cert.org/vuls/id/127587
https://lists.debian.org/debian-lts-announce/2024/11/msg00005.html
https://lists.debian.org/debian-lts-announce/2024/12/msg00000.html
cvelogic Threat Intelligence