pysec - pysec-2022-269

pysec-2022-269

Vulnerability from pysec

Published

2022-09-09 21:15

Modified

2022-09-15 06:38

Details

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of uri_validate functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly uri_validate are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "oauthlib",
        "purl": "pkg:pypi/oauthlib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2e40b412c844ecc4673c3fa3f72181f228bdbacd"
            }
          ],
          "repo": "https://github.com/oauthlib/oauthlib",
          "type": "GIT"
        },
        {
          "events": [
            {
              "introduced": "3.1.1"
            },
            {
              "fixed": "3.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.1.1",
        "3.2.0"
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36087",
    "GHSA-3pgj-pg6c-r5p7"
  ],
  "details": "OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.",
  "id": "PYSEC-2022-269",
  "modified": "2022-09-15T06:38:55.424021Z",
  "published": "2022-09-09T21:15:00Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7"
    },
    {
      "type": "FIX",
      "url": "https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd"
    }
  ]
}

cve-2022-36087

Vulnerability from cvelistv5

Published

2022-09-09 00:00

Modified

2024-08-03 09:52

Severity ?

5.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Summary

OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI

References

▼	URL	Tags
	https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7
	https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd
	https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py
	https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232
	https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRYLYHE5HWF6R2CRLJFUK4PILR47WXOE/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2CQZM5CKOUM4GW2GTAPQEQFPITQ6F7S/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBCQJR3ZF7FVNTJYRVPVSQEQRAYZIUHU/	vendor-advisory
	https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXOPIA6M57CFQPUT6HHSNXCTV6QA3UDI/	vendor-advisory

Impacted products

▼	Vendor	Product
	oauthlib	oauthlib

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T09:52:00.509Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1"
          },
          {
            "name": "FEDORA-2022-5a74a5eea7",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRYLYHE5HWF6R2CRLJFUK4PILR47WXOE/"
          },
          {
            "name": "FEDORA-2023-da094276a2",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2CQZM5CKOUM4GW2GTAPQEQFPITQ6F7S/"
          },
          {
            "name": "FEDORA-2023-49ded4c9a5",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBCQJR3ZF7FVNTJYRVPVSQEQRAYZIUHU/"
          },
          {
            "name": "FEDORA-2023-5ab7049a59",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXOPIA6M57CFQPUT6HHSNXCTV6QA3UDI/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "oauthlib",
          "vendor": "oauthlib",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 3.1.1, \u003c 3.2.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-20",
              "description": "CWE-20: Improper Input Validation",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2023-09-28T03:06:20.018141",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7"
        },
        {
          "url": "https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd"
        },
        {
          "url": "https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py"
        },
        {
          "url": "https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232"
        },
        {
          "url": "https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1"
        },
        {
          "name": "FEDORA-2022-5a74a5eea7",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QRYLYHE5HWF6R2CRLJFUK4PILR47WXOE/"
        },
        {
          "name": "FEDORA-2023-da094276a2",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X2CQZM5CKOUM4GW2GTAPQEQFPITQ6F7S/"
        },
        {
          "name": "FEDORA-2023-49ded4c9a5",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NBCQJR3ZF7FVNTJYRVPVSQEQRAYZIUHU/"
        },
        {
          "name": "FEDORA-2023-5ab7049a59",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LXOPIA6M57CFQPUT6HHSNXCTV6QA3UDI/"
        }
      ],
      "source": {
        "advisory": "GHSA-3pgj-pg6c-r5p7",
        "discovery": "UNKNOWN"
      },
      "title": "OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2022-36087",
    "datePublished": "2022-09-09T00:00:00",
    "dateReserved": "2022-07-15T00:00:00",
    "dateUpdated": "2024-08-03T09:52:00.509Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

ghsa-3pgj-pg6c-r5p7

Vulnerability from github

Published

2022-09-16 21:02

Modified

2024-10-07 16:52

Severity ?

5.7 (Medium) - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

Summary

OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI

Details

Impact

Attacker providing malicious redirect uri can cause DoS to oauthlib's web application.
Attacker can also leverage usage of uri_validate functions depending where it is used.

What kind of vulnerability is it? Who is impacted?

Oauthlib applications using OAuth2.0 provider support or use directly uri_validate function.

Patches

Has the problem been patched? What versions should users upgrade to?

Issue fixed in 3.2.2 release.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The redirect_uri can be verified in web toolkit (i.e bottle-oauthlib, django-oauth-toolkit, ...) before oauthlib is called. A sample check if : is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required.

References

Attack Vector: - Attacker providing malicious redirect uri: https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232 - Vulnerable uri_validate functions: https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py

PoC

python is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path")

Acknowledgement

Special thanks to Sebastian Chnelik - PyUp.io

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "oauthlib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.1.1"
            },
            {
              "fixed": "3.2.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-36087"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-20",
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-09-16T21:02:52Z",
    "nvd_published_at": "2022-09-09T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n- Attacker providing malicious redirect uri can cause DoS to oauthlib\u0027s web application.\n- Attacker can also leverage usage of `uri_validate` functions depending where it is used.\n\n_What kind of vulnerability is it? Who is impacted?_\n\nOauthlib applications using OAuth2.0 provider support or use directly `uri_validate` function.\n\n### Patches\n_Has the problem been patched? What versions should users upgrade to?_\n\nIssue fixed in 3.2.2 release.\n\n### Workarounds\n_Is there a way for users to fix or remediate the vulnerability without upgrading?_\n\nThe `redirect_uri` can be verified in web toolkit (i.e `bottle-oauthlib`, `django-oauth-toolkit`, ...) before oauthlib is called. A sample check if `:` is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required.\n\n### References\nAttack Vector:\n- Attacker providing malicious redirect uri:\nhttps://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232\n- Vulnerable `uri_validate` functions:\nhttps://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py\n\n### PoC\n```python\nis_absolute_uri(\"http://[:::::::::::::::::::::::::::::::::::::::]/path\")\n```\n\n### Acknowledgement\nSpecial thanks to Sebastian Chnelik - PyUp.io",
  "id": "GHSA-3pgj-pg6c-r5p7",
  "modified": "2024-10-07T16:52:33Z",
  "published": "2022-09-16T21:02:52Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36087"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/oauthlib/oauthlib"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232"
    },
    {
      "type": "WEB",
      "url": "https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2022-269.yaml"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXOPIA6M57CFQPUT6HHSNXCTV6QA3UDI"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBCQJR3ZF7FVNTJYRVPVSQEQRAYZIUHU"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYLYHE5HWF6R2CRLJFUK4PILR47WXOE"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2CQZM5CKOUM4GW2GTAPQEQFPITQ6F7S"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

pysec-2022-269

Vulnerability from pysec

cve-2022-36087

Vulnerability from cvelistv5

ghsa-3pgj-pg6c-r5p7

Vulnerability from github

Impact

Patches

Workarounds

References

PoC

Acknowledgement

Tags

Sightings

Nomenclature