CVE-2021-23336: Web Cache Poisoning
Python CPython could allow a remote attacker to bypass security restrictions, caused by a web cache poisoning flaw via urllib.parse.parseqsl and urllib.parse.parseqs. By sending a specially-crafted request parameter cloaking, an attacker could exploit this vulnerability to cause a difference in the interpretation of the request between the proxy and the server.
Other sources
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2021-23336?
CVE-2021-23336 is a vulnerability in the Python CPython package that could allow a remote attacker to bypass security restrictions caused by a web cache poisoning.
How does CVE-2021-23336 work?
CVE-2021-23336 allows an attacker to perform Web Cache Poisoning by using a vector called parameter cloaking, specifically targeting the functions urllib.parse.parse_qsl and urllib.parse.parse_qs.
What is the severity of CVE-2021-23336?
CVE-2021-23336 has a severity level of medium with a score of 5.9.
Which versions of Python are affected by CVE-2021-23336?
The versions of python/cpython affected by CVE-2021-23336 are 0 and before 3.6.13, 3.7.0 and before 3.7.10, 3.8.0 and before 3.8.8, and 3.9.0 and before 3.9.2.
How can I fix CVE-2021-23336?
To fix CVE-2021-23336, update your Python package to version 3.6.13, 3.7.10, 3.8.8, or 3.9.2.