CVE-2022-36087
Summary
| CVE | CVE-2022-36087 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-09-09 21:15:00 UTC |
|---|
| Updated | 2023-11-07 03:49:00 UTC |
|---|
| Description | OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| Merge pull request from GHSA-3pgj-pg6c-r5p7 · oauthlib/oauthlib@2e40b41 · GitHub |
MISC |
github.com |
|
| [SECURITY] Fedora 37 Update: python-oauthlib-3.2.1-1.fc37 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Release 3.2.1 · oauthlib/oauthlib · GitHub |
MISC |
github.com |
|
| [SECURITY] Fedora 39 Update: python-oauthlib-3.2.2-1.fc39 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 38 Update: python-oauthlib-3.2.2-1.fc38 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 37 Update: python-oauthlib-3.2.2-1.fc37 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] Fedora 39 Update: python-oauthlib-3.2.2-1.fc39 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| [SECURITY] Fedora 38 Update: python-oauthlib-3.2.2-1.fc38 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| DoS when attacker provide malicious IPV6 URI · Advisory · oauthlib/oauthlib · GitHub |
CONFIRM |
github.com |
|
| [SECURITY] Fedora 37 Update: python-oauthlib-3.2.1-1.fc37 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| oauthlib/base.py at d4bafd9f1d0eba3766e933b1ac598cbbf37b8914 · oauthlib/oauthlib · GitHub |
MISC |
github.com |
|
| oauthlib/uri_validate.py at 2b8a44855a51ad5a5b0c348a08c2564a2e197ea2 · oauthlib/oauthlib · GitHub |
MISC |
github.com |
|
| [SECURITY] Fedora 37 Update: python-oauthlib-3.2.2-1.fc37 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 160608 Oracle Enterprise Linux Security Update for fence-agents (ELSA-2023-2161)
- 182049 Debian Security Update for python-oauthlib (CVE-2022-36087)
- 198951 Ubuntu Security Notification for OAuthLib Vulnerability (USN-5632-1)
- 241438 Red Hat Update for fence-agents (RHSA-2023:2161)
- 284547 Fedora Security Update for python (FEDORA-2023-49ded4c9a5)
- 284552 Fedora Security Update for python (FEDORA-2023-5ab7049a59)
- 285251 Fedora Security Update for python (FEDORA-2023-da094276a2)
- 296086 Oracle Solaris 11.4 Support Repository Update (SRU) 51.132.1 Missing (CPUOCT2022)
- 672502 EulerOS Security Update for python-oauthlib (EulerOS-SA-2023-1020)
- 672504 EulerOS Security Update for python-oauthlib (EulerOS-SA-2023-1045)
- 941012 AlmaLinux Security Update for fence-agents (ALSA-2023:2161)
