Web Cache Poisoning Vulnerability in Python3 Package
Summary
ALPINE-CVE-2021-23336: The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.pars... Affects python3 versions < 3.8.8-r0. Fixed in 3.8.8-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Python3 package, part of the CPython project, is a widely used programming language that enables developers to create a variety of applications, from web servers to data analysis tools. It is known for its simplicity and readability, making it a popular choice among both beginners and experienced developers. However, certain versions of Python3 are vulnerable to a web cache poisoning attack, which can lead to significant security risks if not addressed.
Vulnerability Detail
The vulnerability arises from the urllib.parse.parse_qsl and urllib.parse.parse_qs functions, which can be exploited through a technique known as parameter cloaking. This occurs when an attacker can manipulate query parameters using a semicolon (;), leading to discrepancies in how requests are interpreted by proxies and servers. As a result, malicious requests may be cached as safe ones, posing a risk of serving harmful content to users. This vulnerability affects Python versions prior to 3.8.8, specifically those from 0 to 3.6.13, 3.7.0 to 3.7.10, 3.8.0 to 3.8.8, and 3.9.0 to 3.9.2.
How To Fix
Minimum fixed version
3.8.8-r0
This is the first release that contains the fix.
sudo apk add --upgrade python3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider configuring your proxy to handle semicolon-separated parameters correctly or avoid using semicolons in query parameters until the package can be updated.
Conclusion
In summary, the Python3 package has a significant vulnerability related to web cache poisoning due to improper handling of query parameters. It is crucial to update to the patched version to mitigate risks. Users should also consider workarounds until they can apply the necessary updates.
See every vulnerability recorded for python3 →
FAQ
Web cache poisoning is an attack where an attacker manipulates the cache of a web proxy or server, causing it to store and serve malicious content to users.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The affected versions include Python3 from 0 to 3.6.13, 3.7.0 to 3.7.10, 3.8.0 to 3.8.8, and 3.9.0 to 3.9.2.
The CVSS score of this vulnerability is 5.9, indicating a moderate level of severity.
If immediate updates are not possible, implement workarounds such as configuring your proxy to handle semicolon-separated parameters or avoiding their use in query strings.
References
Related vulnerabilities
Recent vulnerabilities recorded for python3.
