Skip to content
Appaloosa Scout

Vulnerability · NVD

CVE-2021-23336

MEDIUM 5.9 Vendor bulletin scale — NVD CVSS pending

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Attack vector : Network No privileges required
Show raw CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
EPSS 35.96% moderate exploit risk percentile 98.3%

Tracked apps referencing this CVE

For each app: the affected range, the fixing version, and where the tracked app stands today.

NVD references 12 distinct products for this CVE — only those tracked by Scout (mobile and desktop catalog apps) are listed above. Libraries, servers and out-of-scope products do not appear here. Full list on NVD ↗

Vulnerable CPE configurations (4)
Vendor Product Versions
python python
All platforms (wildcard)
 <3.6.13
python python
All platforms (wildcard)
 ≥3.7.0 <3.7.10
python python
All platforms (wildcard)
 ≥3.8.0 <3.8.8
python python
All platforms (wildcard)
 ≥3.9.0 <3.9.2
View on NVD ↗ Advisory · www.openwall.com Advisory · github.com Advisory · www.oracle.com