CVE-2021-23336 (CNNVD-202102-1124)

MEDIUM
中文标题:
cpython 环境问题漏洞
英文标题:
Web Cache Poisoning
CVSS分数: 5.9
发布时间: 2021-02-15 12:15:20
漏洞类型: 环境问题
状态: PUBLISHED
数据质量分数: 0.30
数据版本: v3
漏洞描述
中文描述:

cpython是Python基金会的用C语言实现的Python解释器。 cpython 存在环境问题漏洞，攻击者可利用该漏洞可以使用分号(;)分隔查询参数，导致恶意请求被缓存为完全安全的请求。以下产品及版本受到影响：before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2。

英文描述:

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

CWE类型:
CWE-444
标签:
（暂无数据）
受影响产品
厂商 产品 版本 版本范围 平台 CPE
python python * - - cpe:2.3:a:python:python:*:*:*:*:*:*:*:*
fedoraproject fedora 32 - - cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:*
fedoraproject fedora 33 - - cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
fedoraproject fedora 34 - - cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
debian debian_linux 9.0 - - cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*
netapp cloud_backup - - - cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:*
netapp inventory_collect_tool - - - cpe:2.3:a:netapp:inventory_collect_tool:-:*:*:*:*:*:*:*
netapp ontap_select_deploy_administration_utility - - - cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:*
netapp snapcenter - - - cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
djangoproject django * - - cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:*
oracle communications_offline_mediation_controller 12.0.0.3.0 - - cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*
oracle communications_pricing_design_center 12.0.0.3.0 - - cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*
oracle enterprise_manager_ops_center 12.4.0.0 - - cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*
oracle zfs_storage_appliance 8.8 - - cpe:2.3:o:oracle:zfs_storage_appliance:8.8:*:*:*:*:*:*:*
解决方案
中文解决方案:
（暂无数据）
英文解决方案:
（暂无数据）
临时解决方案:
（暂无数据）
参考链接
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
[oss-security] 20210219 Django security releases: CVE-2021-23336: Web cache poisoning via ``django.utils.http.limited_parse_qsl()`` mailing-list
cve.org
访问
[debian-lts-announce] 20210219 [SECURITY] [DLA 2569-1] python-django security update mailing-list
cve.org
访问
FEDORA-2021-7547ad987f vendor-advisory
cve.org
访问
FEDORA-2021-f4fd9372c7 vendor-advisory
cve.org
访问
FEDORA-2021-3352c1c802 vendor-advisory
cve.org
访问
FEDORA-2021-7d3a9004e2 vendor-advisory
cve.org
访问
[mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar mailing-list
cve.org
访问
FEDORA-2021-907f3bacae vendor-advisory
cve.org
访问
FEDORA-2021-7c1bb32d13 vendor-advisory
cve.org
访问
FEDORA-2021-b1843407ca vendor-advisory
cve.org
访问
FEDORA-2021-2897f5366c vendor-advisory
cve.org
访问
FEDORA-2021-b326fcb83f vendor-advisory
cve.org
访问
FEDORA-2021-1bb399a5af vendor-advisory
cve.org
访问
FEDORA-2021-ef83e8525a vendor-advisory
cve.org
访问
FEDORA-2021-b76ede8f4d vendor-advisory
cve.org
访问
FEDORA-2021-309bc2e727 vendor-advisory
cve.org
访问
FEDORA-2021-5a09621ebb vendor-advisory
cve.org
访问
FEDORA-2021-e22bb0e548 vendor-advisory
cve.org
访问
FEDORA-2021-e525e48886 vendor-advisory
cve.org
访问
[debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update mailing-list
cve.org
访问
[debian-lts-announce] 20210417 [SECURITY] [DLA 2628-1] python2.7 security update mailing-list
cve.org
访问
FEDORA-2021-b6b6093b3a vendor-advisory
cve.org
访问
GLSA-202104-04 vendor-advisory
cve.org
访问
[airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list
cve.org
访问
[oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list
cve.org
访问
[announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL mailing-list
cve.org
访问
FEDORA-2021-98720f3785 vendor-advisory
cve.org
访问
FEDORA-2021-12df7f7382 vendor-advisory
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
无标题 OTHER
cve.org
访问
[debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update mailing-list
cve.org
访问
CVSS评分详情
3.1 (cna)
MEDIUM
5.9
CVSS向量: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H/E:P/RL:U/RC:C
机密性
NONE
完整性
LOW
可用性
HIGH
时间信息
发布时间:
2021-02-15 12:15:20
修改时间:
2024-09-16 18:55:19
创建时间:
2025-11-11 15:36:40
更新时间:
2025-11-11 15:56:36
利用信息
暂无可利用代码信息
数据源详情
数据源 记录ID 版本 提取时间
CVE cve_CVE-2021-23336 2025-11-11 15:20:49 2025-11-11 07:36:40
NVD nvd_CVE-2021-23336 2025-11-11 14:57:33 2025-11-11 07:45:01
CNNVD cnnvd_CNNVD-202102-1124 2025-11-11 15:10:35 2025-11-11 07:56:36
版本与语言
当前版本: v3
主要语言: EN
支持语言:
EN ZH
安全公告
暂无安全公告信息
变更历史
v3 CNNVD
2025-11-11 15:56:36
vulnerability_type: 未提取 → 环境问题; cnnvd_id: 未提取 → CNNVD-202102-1124; data_sources: ['cve', 'nvd'] → ['cnnvd', 'cve', 'nvd']
查看详细变更
  • vulnerability_type: 未提取 -> 环境问题
  • cnnvd_id: 未提取 -> CNNVD-202102-1124
  • data_sources: ['cve', 'nvd'] -> ['cnnvd', 'cve', 'nvd']
v2 NVD
2025-11-11 15:45:01
affected_products_count: 0 → 14; data_sources: ['cve'] → ['cve', 'nvd']
查看详细变更
  • affected_products_count: 0 -> 14
  • data_sources: ['cve'] -> ['cve', 'nvd']