Server-Side Request Forgery (SSRF) The advisory has been revoked - it doesn't affect any version of package rdflib  (opens in a new tab)

This was deemed not a vulnerability.

rdflib is a Python library for working with RDF, a simple yet powerful language for representing information.

Affected versions of this package are vulnerable to Server-Side Request Forgery (SSRF). rdflib allows resolution of external references, which could enable attackers to have several negative impacts on an application processing untrusted documents or queries. It is recommended to take precautions against the scenarios listed below, including process isolation/sandboxing, runtime audit hooks, or custom URL openers - all of which are equally applicable to RDFLib and the underlying resource resolution functionality of Python.

If a web service takes POSTed JSON-LD data, rdflib will attempt to resolve any URL in the @context. This can lead to:

1. attackers being able to probe internal networks, by having rdflib request potential non-public URLs
2. reflection attacks, if the same or slightly-different URLs are repeated multiple times in the @context
3. resource exhaustion, as the entire remote file is loaded into memory before JSON parsing is attempted
4. Denial of Service, if web or task workers are tied up waiting for extended periods for HTTP requests to complete
5. attackers being able to probe the local filesystem using file:// URLs

• GitHub Issue
• GitHub PR
• GitHub PR
• RDFLib Documentation