Web Cache Poisoning Vulnerability in Python Packages: CVE-2021-23336
Summary
UBUNTU-CVE-2021-23336: The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.pars... Affects python2.7 versions 2.7.5-8ubuntu3 – 2.7.6-8ubuntu0.6+esm9. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Python is a widely-used high-level programming language known for its readability and versatility. It supports multiple programming paradigms and is commonly used for web development, data analysis, artificial intelligence, and more. The vulnerability in question affects various Python packages, specifically those utilizing the urllib.parse module, which is responsible for parsing URLs. This vulnerability allows attackers to exploit the way query parameters are handled, leading to potential cache poisoning.
Vulnerability Detail
The vulnerability identified as CVE-2021-23336 arises from the improper handling of query parameters in Python's urllib.parse.parse_qsl and urllib.parse.parse_qs functions. When an attacker can introduce a semicolon (;) as a parameter separator, it creates a discrepancy in how the request is interpreted by the proxy server and the actual server. This can lead to malicious requests being cached as safe ones, which poses a significant risk as it can allow attackers to manipulate cached content and serve harmful responses to users.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can configure your proxy server to handle semicolons as valid parameter separators. However, this is not a recommended long-term solution and should only be used until the affected packages are updated.
Conclusion
CVE-2021-23336 is a significant vulnerability affecting various Python packages that can lead to web cache poisoning. It is crucial to update affected packages to their patched versions to mitigate the risks associated with this vulnerability. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for python2.7 →
FAQ
CVE-2021-23336 is a vulnerability in Python's urllib.parse module that allows for web cache poisoning through improper handling of query parameters.
If exploited, this vulnerability can lead to malicious requests being cached as safe, potentially serving harmful content to users.
Versions of Python before 3.6.13, 3.7.0 to 3.7.10, 3.8.0 to 3.8.8, and 3.9.0 to 3.9.2 are vulnerable.
You can use Vulert, which monitors open-source vulnerabilities in your software. By simply using a manifest file like package-lock.json, you can check for vulnerabilities without needing to install anything.
The CVSS score for CVE-2021-23336 is 5.9, indicating a moderate level of severity.
Related vulnerabilities
Recent vulnerabilities recorded for python2.7.
