security advisorydebianurlparse issue
This update fixes multiple vulnerabilities concerning the urlparse module as well as vulnerabilities concerning the heapq, hmac, plistlib and ssl modules. CVE-2021-23336 . ------------------------------------------------------------------------- Debian LTS Advisory DLA-3575-1 This email address is being protected from spambots. You need JavaScript enabled to view it. https://www.debian.org/lts/security/ Helmut Grohne September 20, 2023 https://wiki.debian.org/LTS ------------------------------------------------------------------------- Package : python2.7 Version : 2.7.16-2+deb10u3 CVE ID : CVE-2021-23336 CVE-2022-0391 CVE-2022-48560 CVE-2022-48565 CVE-2022-48566 CVE-2023-24329 CVE-2023-40217 This update fixes multiple vulnerabilities concerning the urlparse module as well as vulnerabilities concerning the heapq, hmac, plistlib and ssl modules. CVE-2021-23336 Python was vulnerable to Web Cache Poisoning via urlparse.parse_qsl and urlparse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter. CVE-2022-0391 The urlparse module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL, leading to injection attacks. CVE-2022-48560 A use-after-free exists in Python via heappushpop in heapq. CVE-2022-48565 An XML External Entity (XXE) issue was discovered in Python. The plistlib module no longer acceptsentity declarations in XML plist files to avoid XML vulnerabilities. CVE-2022-48566 An issue was discovered in compare_digest in Lib/hmac.py in Python. Constant-time-defeating optimisations were possible in the accumulator variable in hmac.compare_digest. CVE-2023-24329 An issue in the urlparse component of Python allows attackers to bypass blocklisting methods by supplying a URL that starts with blank characters. CVE-2023-40217 The issue primarily affects servers written in Python (such as HTTP servers) that use TLS client authentication. If a TLS server-side socket is created, receives data into the socket buffer, and then is closed quickly, there is a brief window where the SSLSocket instance will detect the socket as "not connected" and won't initiate a handshake, but buffered data will still be readable from the socket buffer. This data will not be authenticated if the server-side TLS peer is expecting client certificate authentication, and is indistinguishable from valid TLS stream data. Data is limited in size to the amount that will fit in the buffer. (The TLS connection cannot directly be used for data exfiltration because the vulnerable code path requires that the connection be closed on initialization of the SSLSocket.) For Debian 10 buster, these problems have been fixed in version 2.7.16-2+deb10u3. We recommend that you upgrade your python2.7 packages. For the detailed security status of python2.7 please refer to its security tracker page at: https://security-tracker.debian.org/tracker/source-package/python2.7 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS . Tackling various security weaknesses in Python 2.7 concerning the urlparse and heapq libraries within the scope of Debian LTS.. Debian Security, Python Module Issues, Python Updates. . Severity: Critical. LinuxSecurity.com Team
Sep 20, 2023
•Critical
Debian LTS
Refine advisories
