MGASA-2021-0165
- Source
- https://advisories.mageia.org/MGASA-2021-0165.html
- Import Source
- https://advisories.mageia.org/MGASA-2021-0165.json
- JSON Data
- https://api.osv.dev/v1/vulns/MGASA-2021-0165
- Related
- Published
- 2021-04-02T10:16:21Z
- Modified
- 2021-04-02T09:20:16Z
- Summary
- Updated python and python3 packages fix security vulnerability
- Details
-
Updated python and python3 security vulnerability:
The package python/cpython is vulnerable to Web Cache Poisoning via urllib.parse.parseqsl and urllib.parse.parseqs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter (CVE-2021-23336).
- References
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:7 / python3
Package
- Name
- python3
- Purl
- pkg:rpm/mageia/python3?distro=mageia-7
Mageia:7 / python
Package
- Name
- python
- Purl
- pkg:rpm/mageia/python?distro=mageia-7
Mageia:8 / python3
Package
- Name
- python3
- Purl
- pkg:rpm/mageia/python3?distro=mageia-8
Mageia:8 / python
Package
- Name
- python
- Purl
- pkg:rpm/mageia/python?distro=mageia-8