QSN-8759-1: WebOb vulnerabilities
2026-09-15

Summary:
Several security issues were fixed in WebOb.

Details:
It was discovered that WebOb incorrectly handled certain URLs. An
attacker could possibly use this issue to control a redirect or forward
to another URL. This issue was only addressed in Ubuntu 16.04 LTS and
Ubuntu 18.04 LTS. (CVE-2024-42353)

Caleb Brown discovered that WebOb incorrectly handled certain URLs. An
attacker could possibly use this issue to control a redirect or forward
to another URL. (CVE-2026-44889)

Affected QuantaStor releases:
  6.9.1.001 jammy: python3-webob 1:1.8.6-1.1ubuntu0.2 (fixed in 1:1.8.6-1.1ubuntu0.2)
  6.9.0.464 jammy: python3-webob 1:1.8.6-1.1ubuntu0.2 (fixed in 1:1.8.6-1.1ubuntu0.2)
  6.8.6.015 jammy: python3-webob 1:1.8.6-1.1ubuntu0.1 (fixed in 1:1.8.6-1.1ubuntu0.2)
  6.8.5.018 jammy: python3-webob 1:1.8.6-1.1ubuntu0.1 (fixed in 1:1.8.6-1.1ubuntu0.2)
  6.8.4.038 jammy: python3-webob 1:1.8.6-1.1ubuntu0.1 (fixed in 1:1.8.6-1.1ubuntu0.2)
  6.8.3.018 jammy: python3-webob 1:1.8.6-1.1ubuntu0.1 (fixed in 1:1.8.6-1.1ubuntu0.2)
  6.8.2.002 jammy: python3-webob 1:1.8.6-1.1ubuntu0.1 (fixed in 1:1.8.6-1.1ubuntu0.2)
  6.8.1.007 jammy: python3-webob 1:1.8.6-1.1ubuntu0.1 (fixed in 1:1.8.6-1.1ubuntu0.2)
  6.8.0.205 jammy: python3-webob 1:1.8.6-1.1ubuntu0.1 (fixed in 1:1.8.6-1.1ubuntu0.2)

CVEs: CVE-2026-44889, CVE-2024-42353

References:
  https://ubuntu.com/security/notices/USN-8759-1