CVE-2024-42353

The WebOb affected versions have a critical security vulnerability related to improper handling of the HTTP Location header during URL redirection. The issue arises when WebOb normalizes the Location header by combining the request's hostname with the destination URL using Python's `urlparse` and `urljoin` functions. If the destination URL begins with "//", `urlparse` interprets it as a URI without a scheme, using the following string as the hostname. Consequently, `urljoin` replaces the original request hostname with this new hostname, potentially redirecting users to a malicious site. This vulnerability could allow attackers to craft URLs that redirect users from trusted domains to malicious sites, posing significant security risks. The WebOb update ensures that such scenarios are handled correctly, preventing unintended redirects and securing the application against this attack.