Bug#1012482: rdflib: URLInputSource can be abused to retrieve arbitrary documents if used naïvely
Control: tags -1 help Hi all, Apparently, help is needed from upstream rdflib development team on the critical security bug #1023399[0] and their respective entry on their bug tracker[1]. I tried to have a look some time ago, but didn't make sense of the issue. I tag the bug appropriately to raise awareness, in case someone were to have an idea for a proper patch. [0]: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1012482 [1]: https://github.com/RDFLib/rdflib/issues/1844 In hope this helps indeed, -- Étienne Mollier Fingerprint: 8f91 b227 c7d6 f2b1 948c 8236 793c f67e 8f0d 11da Sent from /dev/pts/3, please excuse my verbosity. On air: OSI - Set The Controls For The Heart Of The Sun signature.asc Description: PGP signature
Bug#1012482: rdflib: URLInputSource can be abused to retrieve arbitrary documents if used naïvely
Hi Nilesh, On Sun, 31 Jul 2022, 12:12 Nilesh Patra, wrote: > rdflib has been removed from testing along with a bunch of other packages. > And it is triggering -rm-s for packages in testing anyway. > > Upstream is not actively working on the issue as I see from the github > Issue > URL. -- Do you think we can lower severity of this bug for a bit? > AFAIK, usually it is up to the maintainer to decide about the severity. It could be lowered, yes, but I do not think it is OK to have rdflib with this bug in bookworm. It would be good to ping the upstream as well. Best, Andrius >
Bug#1012482: rdflib: URLInputSource can be abused to retrieve arbitrary documents if used naïvely
Hi Andrius, On Wed, 8 Jun 2022 08:59:13 +0300 Andrius Merkys wrote: > Hello, > > rdflib will attempt to resolve any URL in @context in POSTed JSON-LD > messages, leading to various probing and DDoS vectors, see the upstream > discussion [1]. > > [1] https://github.com/RDFLib/rdflib/issues/1844 rdflib has been removed from testing along with a bunch of other packages. And it is triggering -rm-s for packages in testing anyway. Upstream is not actively working on the issue as I see from the github Issue URL. -- Do you think we can lower severity of this bug for a bit? -- Best, Nilesh signature.asc Description: PGP signature
Bug#1012482: rdflib: URLInputSource can be abused to retrieve arbitrary documents if used naïvely
Source: rdflib Version: 6.1.1 Severity: critical Tags: security upstream Forwarded: https://github.com/RDFLib/rdflib/issues/1844 Hello, rdflib will attempt to resolve any URL in @context in POSTed JSON-LD messages, leading to various probing and DDoS vectors, see the upstream discussion [1]. [1] https://github.com/RDFLib/rdflib/issues/1844 Andrius
