Homepage
About Snyk

safeurl-python@1.0 vulnerabilities

SafeURL is a library that aids developers in protecting against a class of vulnerabilities known as Server Side Request Forgery.

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the safeurl-python package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Access Control

safeurl-python is a library that aids developers in protecting against SSRF

Affected versions of this package are vulnerable to Improper Access Control. The blocklist for hostnames does not restrict Fully Qualified Domain Names (FQDNs).

How to fix Improper Access Control?

There is no fixed version for safeurl-python.

[0,)
  • M
Access Control Bypass

safeurl-python is a library that aids developers in protecting against SSRF

Affected versions of this package are vulnerable to Access Control Bypass due to not blocking FQDNs. If a hostname is blacklisted, it is possible to bypass the blacklist by requesting the FQDN of the host (e.g. adding . to the end).

How to fix Access Control Bypass?

Upgrade safeurl-python to version 1.3 or higher.

[,1.3)
  • M
Server-side Request Forgery (SSRF)

safeurl-python is a library that aids developers in protecting against SSRF

Affected versions of this package are vulnerable to Server-side Request Forgery (SSRF) in some circumstances, due to a permissive regex (re.match("(?i)^%s" % domain, value)) used in domain filtering. This allows a benign domain like victim.com that appears on the allowlist to match the unintended domain victimacomattacker.com. The most common use of the allowlist functionality is for internal resources and therefore the potential for successful SSRF is limited.

How to fix Server-side Request Forgery (SSRF)?

Upgrade safeurl-python to version 1.2 or higher.

[,1.2)
Go back to all versions of this package