The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
El paquete python/cpython desde versiones 0 y anteriores a 3.6.13, desde versiones 3.7.0 y anteriores a 3.7.10, desde versiones 3.8.0 y anteriores a 3.8.8, desde versiones 3.9.0 y anteriores a 3.9.2, son vulnerables al envenenamiento de caché web por medio de urllib.parse.parse_qsl y urllib.parse.parse_qs usando un vector llamado encubrimiento de parámetros. Cuando el atacante puede separar los parámetros de la consulta usando un punto y coma (;), pueden causar una diferencia en la interpretación de la petición entre el proxy (que se ejecuta con la configuración predeterminada) y el servidor. Esto puede resultar en que las peticiones maliciosas se almacenen en caché como completamente seguras, ya que el proxy normalmente no vería el punto y coma como un separador y, por lo tanto, no lo incluiría en una clave de caché de un parámetro sin clave
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
| Attack Vector | NETWORK |
|---|---|
| Attack Complexity | HIGH |
| Privileges Required | NONE |
| User Interaction | REQUIRED |
| Scope | UNCHANGED |
| Confidentiality Impact | NONE |
| Integrity Impact | LOW |
| Availability Impact | HIGH |
AV:N/AC:H/Au:N/C:N/I:P/A:P
| Access Vector | NETWORK |
|---|---|
| Access Complexity | HIGH |
| Authentication | NONE |
| Confidentiality Impact | NONE |
| Integrity Impact | PARTIAL |
| Availability Impact | PARTIAL |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-444
|
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | Secondary |
en
CWE-444
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| python | python | * | <built-in method update of dict object at 0x7fd39c4482c0> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd39c44a240> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd3686c0a80> | Application |
| python | python | * | <built-in method update of dict object at 0x7fd3854bda40> | Application |
| fedoraproject | fedora | 32 | <built-in method update of dict object at 0x7fd39c44b940> | Operating System |
| fedoraproject | fedora | 33 | <built-in method update of dict object at 0x7fd39c44bf80> | Operating System |
| fedoraproject | fedora | 34 | <built-in method update of dict object at 0x7fd3686c3180> | Operating System |
| debian | debian_linux | 9.0 | <built-in method update of dict object at 0x7fd3686c3440> | Operating System |
| netapp | cloud_backup | - | <built-in method update of dict object at 0x7fd2a22482c0> | Application |
| netapp | inventory_collect_tool | - | <built-in method update of dict object at 0x7fd39c448140> | Application |
| netapp | ontap_select_deploy_administration_utility | - | <built-in method update of dict object at 0x7fd3854bde40> | Application |
| netapp | snapcenter | - | <built-in method update of dict object at 0x7fd36b4e9100> | Application |
| djangoproject | django | * | <built-in method update of dict object at 0x7fd39c40f840> | Application |
| djangoproject | django | * | <built-in method update of dict object at 0x7fd3854bd740> | Application |
| djangoproject | django | * | <built-in method update of dict object at 0x7fd3686c1c00> | Application |
| oracle | communications_offline_mediation_controller | 12.0.0.3.0 | <built-in method update of dict object at 0x7fd3845fdd00> | Application |
| oracle | communications_pricing_design_center | 12.0.0.3.0 | <built-in method update of dict object at 0x7fd39c44a140> | Application |
| oracle | enterprise_manager_ops_center | 12.4.0.0 | <built-in method update of dict object at 0x7fd3854bf040> | Application |
| oracle | zfs_storage_appliance | 8.8 | <built-in method update of dict object at 0x7fd37039b300> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:python:python:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:inventory_collect_tool:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:oracle:zfs_storage_appliance:8.8:*:*:*:*:*:*:* |