{ "dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": { "state": "PUBLISHED", "cveId": "CVE-2021-23336", "assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "dateUpdated": "2024-09-16T18:55:19.315Z", "dateReserved": "2021-01-08T00:00:00", "datePublished": "2021-02-15T12:15:20.788790Z" }, "containers": { "cna": { "title": "Web Cache Poisoning", "datePublic": "2021-02-15T00:00:00", "providerMetadata": { "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk", "dateUpdated": "2023-09-20T21:06:13.958312" }, "descriptions": [ { "lang": "en", "value": "The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter." } ], "affected": [ { "vendor": "n/a", "product": "python/cpython", "versions": [ { "version": "0", "status": "affected", "lessThan": "unspecified", "versionType": "custom" }, { "version": "unspecified", "lessThan": "3.6.13", "status": "affected", "versionType": "custom" }, { "version": "3.7.0", "status": "affected", "lessThan": "unspecified", "versionType": "custom" }, { "version": "unspecified", "lessThan": "3.7.10", "status": "affected", "versionType": "custom" }, { "version": "3.8.0", "status": "affected", "lessThan": "unspecified", "versionType": "custom" }, { "version": "unspecified", "lessThan": "3.8.8", "status": "affected", "versionType": "custom" }, { "version": "3.9.0", "status": "affected", "lessThan": "unspecified", "versionType": "custom" }, { "version": "unspecified", "lessThan": "3.9.2", "status": "affected", "versionType": "custom" } ] } ], "references": [ { "url": "https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933" }, { "url": "https://github.com/python/cpython/pull/24297" }, { "url": "https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/" }, { "name": "[oss-security] 20210219 Django security releases: CVE-2021-23336: Web cache poisoning via ``django.utils.http.limited_parse_qsl()``", "tags": [ "mailing-list" ], "url": "http://www.openwall.com/lists/oss-security/2021/02/19/4" }, { "name": "[debian-lts-announce] 20210219 [SECURITY] [DLA 2569-1] python-django security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html" }, { "name": "FEDORA-2021-7547ad987f", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/" }, { "name": "FEDORA-2021-f4fd9372c7", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/" }, { "name": "FEDORA-2021-3352c1c802", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/" }, { "name": "FEDORA-2021-7d3a9004e2", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/" }, { "name": "[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E" }, { "name": "FEDORA-2021-907f3bacae", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/" }, { "name": "FEDORA-2021-7c1bb32d13", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/" }, { "name": "FEDORA-2021-b1843407ca", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/" }, { "name": "FEDORA-2021-2897f5366c", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/" }, { "name": "FEDORA-2021-b326fcb83f", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/" }, { "name": "FEDORA-2021-1bb399a5af", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/" }, { "name": "FEDORA-2021-ef83e8525a", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/" }, { "name": "FEDORA-2021-b76ede8f4d", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/" }, { "name": "FEDORA-2021-309bc2e727", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/" }, { "name": "FEDORA-2021-5a09621ebb", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/" }, { "name": "FEDORA-2021-e22bb0e548", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/" }, { "name": "FEDORA-2021-e525e48886", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/" }, { "name": "[debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html" }, { "name": "[debian-lts-announce] 20210417 [SECURITY] [DLA 2628-1] python2.7 security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html" }, { "name": "FEDORA-2021-b6b6093b3a", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/" }, { "name": "GLSA-202104-04", "tags": [ "vendor-advisory" ], "url": "https://security.gentoo.org/glsa/202104-04" }, { "name": "[airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E" }, { "name": "[oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL", "tags": [ "mailing-list" ], "url": "http://www.openwall.com/lists/oss-security/2021/05/01/2" }, { "name": "[announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL", "tags": [ "mailing-list" ], "url": "https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E" }, { "name": "FEDORA-2021-98720f3785", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/" }, { "name": "FEDORA-2021-12df7f7382", "tags": [ "vendor-advisory" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/" }, { "url": "https://www.oracle.com/security-alerts/cpuApr2021.html" }, { "url": "https://security.netapp.com/advisory/ntap-20210326-0004/" }, { "url": "https://www.oracle.com//security-alerts/cpujul2021.html" }, { "url": "https://www.oracle.com/security-alerts/cpuoct2021.html" }, { "url": "https://www.oracle.com/security-alerts/cpujan2022.html" }, { "name": "[debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update", "tags": [ "mailing-list" ], "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html" } ], "credits": [ { "lang": "en", "value": "Snyk Security Team" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H/E:P/RL:U/RC:C", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "HIGH", "exploitCodeMaturity": "PROOF_OF_CONCEPT", "remediationLevel": "UNAVAILABLE", "reportConfidence": "CONFIRMED", "baseScore": 5.9, "temporalScore": 5.6, "baseSeverity": "MEDIUM", "temporalSeverity": "MEDIUM" } } ], "problemTypes": [ { "descriptions": [ { "type": "text", "lang": "en", "description": "Web Cache Poisoning" } ] } ] }, "adp": [ { "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T19:05:55.612Z" }, "title": "CVE Program Container", "references": [ { "url": "https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933", "tags": [ "x_transferred" ] }, { "url": "https://github.com/python/cpython/pull/24297", "tags": [ "x_transferred" ] }, { "url": "https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/", "tags": [ "x_transferred" ] }, { "name": "[oss-security] 20210219 Django security releases: CVE-2021-23336: Web cache poisoning via ``django.utils.http.limited_parse_qsl()``", "tags": [ "mailing-list", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2021/02/19/4" }, { "name": "[debian-lts-announce] 20210219 [SECURITY] [DLA 2569-1] python-django security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2021/02/msg00030.html" }, { "name": "FEDORA-2021-7547ad987f", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HCQTCSP6SCVIYNIRUJC5X7YBVUHPLSC4/" }, { "name": "FEDORA-2021-f4fd9372c7", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/" }, { "name": "FEDORA-2021-3352c1c802", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MP572OLHMS7MZO4KUPSCIMSZIA5IZZ62/" }, { "name": "FEDORA-2021-7d3a9004e2", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/" }, { "name": "[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rf9fa47ab66495c78bb4120b0754dd9531ca2ff0430f6685ac9b07772%40%3Cdev.mina.apache.org%3E" }, { "name": "FEDORA-2021-907f3bacae", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FONHJIOZOFD7CD35KZL6SVBUTMBPGZGA/" }, { "name": "FEDORA-2021-7c1bb32d13", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KJXCMHLY7H3FIYLE4OKDYUILU2CCRUCZ/" }, { "name": "FEDORA-2021-b1843407ca", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3YKKDLXL3UEZ3J426C2XTBS63AHE46SM/" }, { "name": "FEDORA-2021-2897f5366c", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/TFTELUMWZE3KV3JB2H5EE6VFRZFRD5MV/" }, { "name": "FEDORA-2021-b326fcb83f", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/OAGSWNGZJ6HQ5ISA67SNMK3CJRKICET7/" }, { "name": "FEDORA-2021-1bb399a5af", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NJSCSN722JO2E2AGPWD4NTGVELVRPB4R/" }, { "name": "FEDORA-2021-ef83e8525a", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HZTM7KLHFCE3LWSEVO2NAFLUHMGYMCRY/" }, { "name": "FEDORA-2021-b76ede8f4d", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3EPYWWFDV22CJ5AOH5VCE72DOASZZ255/" }, { "name": "FEDORA-2021-309bc2e727", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/IHQDU7NXA7EWAE4W7VO6MURVJIULEPPR/" }, { "name": "FEDORA-2021-5a09621ebb", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/W2LSKBEFI5SYEY5FM6ICZVZM5WRQUCS4/" }, { "name": "FEDORA-2021-e22bb0e548", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/46N6A52EGSXHJYCZWVMBJJIH4NWIV2B5/" }, { "name": "FEDORA-2021-e525e48886", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LVNH6Z24IG3E67ZCQGGJ46FZB4XFLQNZ/" }, { "name": "[debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00005.html" }, { "name": "[debian-lts-announce] 20210417 [SECURITY] [DLA 2628-1] python2.7 security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2021/04/msg00015.html" }, { "name": "FEDORA-2021-b6b6093b3a", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/N6VXJZSZ6N64AILJX4CTMACYGQGHHD5C/" }, { "name": "GLSA-202104-04", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://security.gentoo.org/glsa/202104-04" }, { "name": "[airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/ra8ce70088ba291f358e077cafdb14d174b7a1ce9a9d86d1b332d6367%40%3Cusers.airflow.apache.org%3E" }, { "name": "[oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL", "tags": [ "mailing-list", "x_transferred" ], "url": "http://www.openwall.com/lists/oss-security/2021/05/01/2" }, { "name": "[announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.apache.org/thread.html/rc005f4de9d9b0ba943ceb8ff5a21a5c6ff8a9df52632476698d99432%40%3Cannounce.apache.org%3E" }, { "name": "FEDORA-2021-98720f3785", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SGIY6I4YS3WOXAK4SXKIEOC2G4VZKIR7/" }, { "name": "FEDORA-2021-12df7f7382", "tags": [ "vendor-advisory", "x_transferred" ], "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RSLQD5CCM75IZGAMBDGUZEATYU5YSGJ7/" }, { "url": "https://www.oracle.com/security-alerts/cpuApr2021.html", "tags": [ "x_transferred" ] }, { "url": "https://security.netapp.com/advisory/ntap-20210326-0004/", "tags": [ "x_transferred" ] }, { "url": "https://www.oracle.com//security-alerts/cpujul2021.html", "tags": [ "x_transferred" ] }, { "url": "https://www.oracle.com/security-alerts/cpuoct2021.html", "tags": [ "x_transferred" ] }, { "url": "https://www.oracle.com/security-alerts/cpujan2022.html", "tags": [ "x_transferred" ] }, { "name": "[debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update", "tags": [ "mailing-list", "x_transferred" ], "url": "https://lists.debian.org/debian-lts-announce/2023/09/msg00022.html" } ] } ] } }