Bug#1012482: rdflib: URLInputSource can be abused to retrieve arbitrary documents if used naïvely

2022-11-04 Thread Étienne Mollier
Control: tags -1 help Hi all, Apparently, help is needed from upstream rdflib development team on the critical security bug #1023399[0] and their respective entry on their bug tracker[1]. I tried to have a look some time ago, but didn't make sense of the issue. I tag the bug appropriately to

Bug#1012482: rdflib: URLInputSource can be abused to retrieve arbitrary documents if used naïvely

2022-07-31 Thread Andrius Merkys
Hi Nilesh, On Sun, 31 Jul 2022, 12:12 Nilesh Patra, wrote: > rdflib has been removed from testing along with a bunch of other packages. > And it is triggering -rm-s for packages in testing anyway. > > Upstream is not actively working on the issue as I see from the github > Issue > URL. -- Do

Bug#1012482: rdflib: URLInputSource can be abused to retrieve arbitrary documents if used naïvely

2022-07-31 Thread Nilesh Patra
Hi Andrius, On Wed, 8 Jun 2022 08:59:13 +0300 Andrius Merkys wrote: > Hello, > > rdflib will attempt to resolve any URL in @context in POSTed JSON-LD > messages, leading to various probing and DDoS vectors, see the upstream > discussion [1]. > > [1] https://github.com/RDFLib/rdflib/issues/1844

Bug#1012482: rdflib: URLInputSource can be abused to retrieve arbitrary documents if used naïvely

2022-06-08 Thread Andrius Merkys
Source: rdflib Version: 6.1.1 Severity: critical Tags: security upstream Forwarded: https://github.com/RDFLib/rdflib/issues/1844 Hello, rdflib will attempt to resolve any URL in @context in POSTed JSON-LD messages, leading to various probing and DDoS vectors, see the upstream discussion [1].