CVE-2021-23336

 

Published at: - 15-02-2021 02:15

Last modified: - 30-06-2022 05:44

Total changes: - 29

Description

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Common Vulnerability Scoring System (CVSS)

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

 

Verification logic

 

Reference

• https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
• https://github.com/python/cpython/pull/24297
• https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
• [oss-security] 20210219 Django security releases: CVE-2021-23336: Web cache poisoning via ``django.utils.http.limited_parse_qsl()``-Mailing List, Patch, Third Party Advisory
• [debian-lts-announce] 20210219 [SECURITY] [DLA 2569-1] python-django security update-Mailing List, Third Party Advisory
• FEDORA-2021-7547ad987f-Mailing List, Third Party Advisory
• FEDORA-2021-f4fd9372c7-Mailing List, Third Party Advisory
• FEDORA-2021-7d3a9004e2-Mailing List, Third Party Advisory
• FEDORA-2021-3352c1c802-Mailing List, Third Party Advisory
• [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar-Mailing List, Third Party Advisory
• FEDORA-2021-907f3bacae-Mailing List, Third Party Advisory
• FEDORA-2021-7c1bb32d13-Mailing List, Third Party Advisory
• FEDORA-2021-b1843407ca-Mailing List, Third Party Advisory
• FEDORA-2021-2897f5366c-Mailing List, Third Party Advisory
• FEDORA-2021-b326fcb83f-Mailing List, Third Party Advisory
• FEDORA-2021-1bb399a5af-Mailing List, Third Party Advisory
• FEDORA-2021-ef83e8525a-Mailing List, Third Party Advisory
• FEDORA-2021-b76ede8f4d-Mailing List, Third Party Advisory
• FEDORA-2021-309bc2e727-Mailing List, Third Party Advisory
• FEDORA-2021-e525e48886-Mailing List, Third Party Advisory
• FEDORA-2021-5a09621ebb-Mailing List, Third Party Advisory
• FEDORA-2021-e22bb0e548-Mailing List, Third Party Advisory
• https://security.netapp.com/advisory/ntap-20210326-0004/
• [debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update-Mailing List, Third Party Advisory
• [debian-lts-announce] 20210417 [SECURITY] [DLA 2628-1] python2.7 security update-Mailing List, Third Party Advisory
• FEDORA-2021-b6b6093b3a-Third Party Advisory
• GLSA-202104-04-Third Party Advisory
• [airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL-Mailing List, Third Party Advisory
• [oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL-Mailing List, Third Party Advisory
• [announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL-Mailing List, Third Party Advisory
• FEDORA-2021-98720f3785-Mailing List, Third Party Advisory
• FEDORA-2021-12df7f7382-Mailing List, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuApr2021.html
• N/A-Patch, Third Party Advisory
• https://www.oracle.com/security-alerts/cpuoct2021.html
• https://www.oracle.com/security-alerts/cpujan2022.html

 

Keywords

NVD

 

CVE-2021-23336

 

CVE

 

Common vulnerabilities & exposures

 

CVSS

 

Common vulnerability scoring system

 

Security

 

Vulnerabilities

 

Exposures