Orta CVSS 5.9 PoC var

CVE-2021-23336: Python: güvenlik açığı

Yayın: 15 Şubat 2021 16:15 · Güncelleme: 6 Kasım 2026 09:46

Açıklama (NVD)

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Özet bilgiler

Ürün: Python Python
CVSS v3.1: 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
EPSS: %40,74 (yüzdelik 99)
CWE: CWE-444
Yama: Mevcut

Etkilenen sürümler

Ürün	Başlangıç	Bitiş	Düzeltildi
python-python	—	—	3.6.13
python-python	3.7.0	—	3.7.10
python-python	3.8.0	—	3.8.8
python-python	3.9.0	—	3.9.2
fedoraproject-fedora	32	32	—
fedoraproject-fedora	33	33	—
fedoraproject-fedora	34	34	—
debian-debian-linux	9.0	9.0	—
netapp-cloud-backup	—	—	—
netapp-inventory-collect-tool	—	—	—
netapp-ontap-select-deploy-administration-utility	—	—	—
netapp-snapcenter	—	—	—
djangoproject-django	2.2	—	2.2.19
djangoproject-django	3.0	—	3.0.13
djangoproject-django	3.1	—	3.1.7
oracle-communications-offline-mediation-controller	12.0.0.3.0	12.0.0.3.0	—
oracle-communications-pricing-design-center	12.0.0.3.0	12.0.0.3.0	—
oracle-enterprise-manager-ops-center	12.4.0.0	12.4.0.0	—
oracle-zfs-storage-appliance	8.8	8.8	—

Kaynaklar

Uygulamada aç Tüm CVE kayıtları