Path: csiph.com!aioe.org!bofh.it!news.nic.it!robomod From: =?UTF-8?Q?=C3=89tienne?= Mollier Newsgroups: linux.debian.bugs.dist,linux.debian.maint.python Subject: Bug#1012482: rdflib: URLInputSource can be abused to retrieve arbitrary documents if used =?UTF-8?Q?na=C3=AFvely?= Date: Fri, 04 Nov 2022 19:10:01 +0100 Message-ID: References: X-Mailbox-Line: From debian-bugs-dist-request@lists.debian.org Fri Nov 4 18:09:09 2022 Old-Return-Path: X-Spam-Flag: NO X-Spam-Score: -3.751 Reply-To: =?UTF-8?Q?=C3=89tienne?= Mollier , 1012482@bugs.debian.org Resent-To: debian-bugs-dist@lists.debian.org Resent-Cc: Debian Python Team X-Debian-Pr-Message: followup 1012482 X-Debian-Pr-Package: src:rdflib X-Debian-Pr-Keywords: security upstream X-Debian-Pr-Source: rdflib X-Ea-Auth: nRF4EybN5AkFNbPnik9AsW8Bicf/wswjhmtP1tQfda6faP2FAMhi79IlyA4alhiUZbchw+cEwL0YDk9caI/sGn4g7fzgqur8st/DaxwsUlI= MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha512; protocol="application/pgp-signature"; boundary="6c9K8Pznno26E+C1" Content-Disposition: inline X-Debian-Message: from BTS X-Mailing-List: archive/latest/1742175 List-ID: List-URL: Approved: robomod@news.nic.it Lines: 48 Organization: linux.* mail to news gateway Sender: robomod@news.nic.it X-Original-Cc: debian-python@lists.debian.org X-Original-Date: Fri, 4 Nov 2022 19:07:40 +0100 X-Original-Message-ID: X-Original-References: <8e0bcfb3-9ad1-2c3e-4051-172614b863aa@debian.org> Xref: csiph.com linux.debian.bugs.dist:1123633 linux.debian.maint.python:14604 --6c9K8Pznno26E+C1 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: quoted-printable Control: tags -1 help Hi all, Apparently, help is needed from upstream rdflib development team on the critical security bug #1023399[0] and their respective entry on their bug tracker[1]. I tried to have a look some time ago, but didn't make sense of the issue. I tag the bug appropriately to raise awareness, in case someone were to have an idea for a proper patch. [0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=3D1012482 [1]: https://github.com/RDFLib/rdflib/issues/1844 In hope this helps indeed, --=20 =C3=89tienne Mollier Fingerprint: 8f91 b227 c7d6 f2b1 948c 8236 793c f67e 8f0d 11da Sent from /dev/pts/3, please excuse my verbosity. On air: OSI - Set The Controls For The Heart Of The Sun --6c9K8Pznno26E+C1 Content-Type: application/pgp-signature; name="signature.asc" -----BEGIN PGP SIGNATURE----- iQIzBAABCgAdFiEEj5GyJ8fW8rGUjII2eTz2fo8NEdoFAmNlVOwACgkQeTz2fo8N EdpD0hAAtsHCfOd8l3u6AOM3JVTiCPn1yHUNfW89jiYUcu3HQWrK3mNQToNn1X8c ZDUTxjw1fnjiq+OmX9P6hb2l7BmKCnd6ABDgUAGQ9Uws5OEbmeOOdVHk3lqtLkVh aHF3WcFcMFIssf94Rfc2mt+oOlg1WXW9rzkNTfJOZut4TgKZ0AW3Iwfp7AxuWTAA i1cbEyOu94dQcWKraFf3X3RWMLAkUbkZDCfaeHm1IbB+S7tLOhkyWzVQH4cZpkhF aevKfbkjD3kK0kFHazlzz/03F4acSXKcbOwEpyEpsxZCqxwYj0dxJIEtmQlsnGTl 5lsNYLkmr2SMUAWuc1gHBut6IAmtA4fHKzGQuxEy/JsObUtD+haR27R8EgfXKZnn YHWQbxSCQbtzcuDt2MH2uHWF0L0qmKa+N95dam+PoJD2YKlVoSZ2Qsrv1XTBaCDi m0svTIiWqOp4Fs6gYXO3bNHA5oG82zKU1y3qYiZjtsDgQqHbvPoivH8t6L2imgGF zsUb93MysRXqEkluygBRF52JRcFIxi+RONUyI6qB/y7VL7OE4Kd9PWI5HebofUlZ LsanOCBVzuoDd3qFIV9aEMAkdF+ObgFMn+jgHYJ+xl1k1hCEaIbVzkOIQvXy6a7U EtvJkFGLtC4rN+GA2Xlcog22Xrb4Bf7JARQ3uQR1wcUEDp1LRUs= =CRPG -----END PGP SIGNATURE----- --6c9K8Pznno26E+C1--