Input validation error in Django - CVE-2021-23336

Vulnerability identifier: #VU50814

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-23336

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform web cache spoofing attack.

The vulnerability exists due to insufficient validation of user-supplied input in django.utils.http.limited_parse_qsl() when parsing strings with a semicolon (";"). A remote attacker can pass specially crafted data to the application and perform a spoofing attack.

Django
Arch Linux
Amazon Linux AMI
Gentoo Linux
SUSE Manager Server
SUSE CaaS Platform
SUSE Manager Retail Branch Server
SUSE Manager Proxy
SUSE MicroOS
SUSE Enterprise Storage
SUSE OpenStack Cloud
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for x86_64
Anolis OS
Red Hat Enterprise Linux for Power, little endian
Red Hat CodeReady Linux Builder for x86_64
Red Hat CodeReady Linux Builder for Power, little endian
Red Hat CodeReady Linux Builder for ARM 64
Red Hat CodeReady Linux Builder for IBM z Systems
Fedora
SUSE OpenStack Cloud Crowbar
HPE Helion Openstack
SUSE Linux Enterprise Module for Web Scripting
SUSE Linux Enterprise Server for SAP
SUSE Linux Enterprise Server
SUSE Linux Enterprise Workstation Extension
SUSE Linux Enterprise Software Development Kit
SUSE Linux Enterprise High Performance Computing
SUSE Linux Enterprise Module for Basesystem
SUSE Linux Enterprise Module for Development Tools
SUSE Linux Enterprise Module for Desktop Applications
SUSE Linux Enterprise Module for Python2
Ubuntu
openEuler
Voice Gateway
IBM Observability with Instana
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
Cloud Pak for Security (CP4S)
IBM Qradar SIEM
Red Hat OpenShift Jaeger
python3 (Red Hat package)
python38-wcwidth
python38-PyMySQL
python38-pluggy
python38-Cython
python38-wheel-wheel
python38-wheel
python38-markupsafe
python38-asn1crypto
python38-atomicwrites
python38-scipy
python38-pysocks
python38-py
python3-django (Ubuntu package)
python-django (Ubuntu package)
python38-six
python38-cffi
python38-numpy-doc
python38-numpy-f2py
python38-numpy
python38-urllib3
python-django
python38-pyparsing
python38-babel
libpython2_7-1_0
libpython2_7-1_0-debuginfo
python
python-base
python-tk
python-base-debugsource
python-curses
python-curses-debuginfo
python-debuginfo
python-debugsource
python-devel
python-gdbm
python-gdbm-debuginfo
python-base-debuginfo
python-tk-debuginfo
python-xml
python-xml-debuginfo
python2.7
python-idle
libpython2_7-1_0-32bit
python-base-debuginfo-32bit
python-base-32bit
python-32bit
libpython2_7-1_0-debuginfo-32bit
python-debuginfo-32bit
python-demo
python-doc-pdf
python-doc
python38-cryptography
python38-psycopg2-doc
python38-psycopg2-tests
python38-psycopg2
python38-idna
python38-jinja2
python38-pycparser
python38-requests
python38-chardet
python-django3
python34
libpython3_4m1_0-debuginfo-32bit
python3-base-debuginfo
python3-base-debugsource
python3-dbm
python3-dbm-debuginfo
python3-debuginfo
python3-debugsource
python3-devel
python3-devel-debuginfo
libpython3_4m1_0
libpython3_4m1_0-debuginfo
python3
python3-base
python3-curses
python3-curses-debuginfo
python3-tk
python3-tk-debuginfo
libpython3_4m1_0-32bit
python3-base-debuginfo-32bit
python35
python36
python3.6
python3-idle
libpython3_6m1_0
python3-tools
python3-core-debugsource
libpython3_6m1_0-debuginfo
python36-base
python36-base-debuginfo
python36-debuginfo
python36-debugsource
python3-debug
python3-help
python37
python3.7
mingw-python3
python3.8
python3-docs
python38-libs
python38-devel
python38-debug
python38-rpm-macros
python38-idle
python38-tkinter
python38-test
python38
python39
python3.9
python3.10
python38-ply
python38-lxml
python38-pytest
python38-mod_wsgi
python38-pyyaml
python38-psutil
python38-more-itertools
python38-packaging
python38-attrs
python38-pip-wheel
python38-pip
python38-setuptools
python38-setuptools-wheel
python38-pytz
FortiAnalyzer
SmartFabric OS10
PowerStore X
PowerStore T
Enterprise SONiC
Web Terminal
OpenShift Virtualization

Install updates from vendor's website.

Django - addressed in versions 2.2.19, 3.0.13, 3.1.7
Voice Gateway - update to 1.0.8.12
IBM Observability with Instana - update to 1.0.299
Cloud Pak for Security (CP4S) - update to 1.8.0.0
Red Hat OpenShift Jaeger - addressed in versions 1.17.9, 1.20.4
python3 (Red Hat package) - update to 3.6.8-37.el8
FortiAnalyzer - addressed in versions 6.4.8, 7.0.3
SmartFabric OS10 - update to 10.5.4.11
python38-wcwidth - update to 0.1.7-16
python38-PyMySQL - update to 0.10.1-1
python38-pluggy - update to 0.13.0-3
python38-Cython - update to 0.29.14-4
python38-wheel-wheel - update to 0.33.6-6
python38-wheel - update to 0.33.6-6
python38-markupsafe - update to 1.1.1-6
python38-asn1crypto - update to 1.2.0-3
Web Terminal - update to 1.3
python38-atomicwrites - update to 1.3.0-8
python38-scipy - update to 1.3.1-4
python38-pysocks - update to 1.7.1-4
python38-py - update to 1.8.0-8
python3-django (Ubuntu package) - addressed in versions 1:1.11.11-1ubuntu1.11, 2:2.2.12-1ubuntu0.4, 2:2.2.16-1ubuntu0.2
python-django (Ubuntu package) - update to 1:1.11.11-1ubuntu1.11
python38-six - update to 1.12.0-10
python38-cffi - update to 1.13.2-3
python38-numpy-doc - update to 1.17.3-6
python38-numpy-f2py - update to 1.17.3-6
python38-numpy - update to 1.17.3-6
python38-urllib3 - update to 1.25.7-5
python-django - addressed in versions 2.2.19-1.el8, 3.0.13-1.fc32, 3.0.13-1.fc33, 3.1.7-1.fc34
python38-pyparsing - update to 2.4.5-3
OpenShift Virtualization - addressed in versions 2.6.6, 4.8.0
python38-babel - update to 2.7.0-11
libpython2_7-1_0 - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
libpython2_7-1_0-debuginfo - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-base - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-tk - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-base-debugsource - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-curses - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-curses-debuginfo - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-debuginfo - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-debugsource - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-devel - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-gdbm - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-gdbm-debuginfo - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-base-debuginfo - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-tk-debuginfo - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-xml - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python-xml-debuginfo - addressed in versions 2.7.18-7.55.1, 2.7.18-28.67.1
python2.7 - addressed in versions 2.7.18-11.fc33, 2.7.18-11.fc34, 2.7.18-11.fc35
python-idle - update to 2.7.18-28.67.1
libpython2_7-1_0-32bit - update to 2.7.18-28.67.1
python-base-debuginfo-32bit - update to 2.7.18-28.67.1
python-base-32bit - update to 2.7.18-28.67.1
python-32bit - update to 2.7.18-28.67.1
libpython2_7-1_0-debuginfo-32bit - update to 2.7.18-28.67.1
python-debuginfo-32bit - update to 2.7.18-28.67.1
python-demo - update to 2.7.18-28.67.1
python-doc-pdf - update to 2.7.18-28.67.1
python-doc - update to 2.7.18-28.67.1
python38-cryptography - update to 2.8-3
python38-psycopg2-doc - update to 2.8.4-4
python38-psycopg2-tests - update to 2.8.4-4
python38-psycopg2 - update to 2.8.4-4
python38-idna - update to 2.8-6
python38-jinja2 - update to 2.10.3-5
python38-pycparser - update to 2.19-3
python38-requests - update to 2.22.0-9
python38-chardet - update to 3.0.4-19
PowerStore X - update to 3.2.1.0-1989710
PowerStore T - update to 3.2.1.0-1989710
python-django3 - update to 3.2.15-1.fc38
python34 - update to 3.4.10-1.55
libpython3_4m1_0-debuginfo-32bit - update to 3.4.10-25.66.1
python3-base-debuginfo - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-base-debugsource - update to 3.4.10-25.66.1
python3-dbm - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-dbm-debuginfo - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-debuginfo - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-debugsource - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-devel - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-devel-debuginfo - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
libpython3_4m1_0 - update to 3.4.10-25.66.1
libpython3_4m1_0-debuginfo - update to 3.4.10-25.66.1
python3 - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-base - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-curses - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-curses-debuginfo - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-tk - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
python3-tk-debuginfo - addressed in versions 3.4.10-25.66.1, 3.6.13-3.78.1
libpython3_4m1_0-32bit - update to 3.4.10-25.66.1
python3-base-debuginfo-32bit - update to 3.4.10-25.66.1
python35 - update to 3.5.10-1.30
python36 - update to 3.6.12-1.21
python36 - update to 3.6.13-1.fc32
python3.6 - addressed in versions 3.6.13-1.fc33, 3.6.13-1.fc34, 3.6.13-1.fc35
python3-idle - update to 3.6.13-3.78.1
libpython3_6m1_0 - addressed in versions 3.6.13-3.78.1, 3.6.13-4.36.1
python3-tools - update to 3.6.13-3.78.1
python3-core-debugsource - update to 3.6.13-3.78.1
libpython3_6m1_0-debuginfo - addressed in versions 3.6.13-3.78.1, 3.6.13-4.36.1
python36 - update to 3.6.13-4.36.1
python36-base - update to 3.6.13-4.36.1
python36-base-debuginfo - update to 3.6.13-4.36.1
python36-debuginfo - update to 3.6.13-4.36.1
python36-debugsource - update to 3.6.13-4.36.1
python3-debug - update to 3.7.9-8
python3-help - update to 3.7.9-8
python3-debuginfo - update to 3.7.9-8
python3-debugsource - update to 3.7.9-8
python3 - update to 3.7.9-8
python3-devel - update to 3.7.9-8
python37 - update to 3.7.10-1.fc32
python3.7 - update to 3.7.10-1.fc33
mingw-python3 - addressed in versions 3.8.8-1.fc32, 3.9.2-1.fc33, 3.9.2-2.fc34
python3 - addressed in versions 3.8.8-1.fc32, 3.8.9-1.fc32
python3.8 - update to 3.8.8-1.fc33
python3-docs - update to 3.8.9-1.fc32
python38-libs - update to 3.8.12-1.0.1
python38-devel - update to 3.8.12-1.0.1
python38-debug - update to 3.8.12-1.0.1
python38-rpm-macros - update to 3.8.12-1.0.1
python38-idle - update to 3.8.12-1.0.1
python38-tkinter - update to 3.8.12-1.0.1
python38-test - update to 3.8.12-1.0.1
python38 - update to 3.8.12-1.0.1
python39 - update to 3.9.2-1.fc32
python3.9 - update to 3.9.2-1.fc33
python3.10 - addressed in versions 3.10.0~a6-1.fc32, 3.10.0~a6-1.fc33, 3.10.0~a6-1.fc34
python38-ply - update to 3.11-10
Enterprise SONiC - update to 4.1.2
python38-lxml - update to 4.4.1-7
python38-pytest - update to 4.6.6-3
python38-mod_wsgi - update to 4.6.8-3
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.9
python38-pyyaml - update to 5.4.1-1
python38-psutil - update to 5.6.4-4
python38-more-itertools - update to 7.2.0-5
IBM Qradar SIEM - update to 7.5.0 Update Pack 6
python38-packaging - update to 19.2-3
python38-attrs - update to 19.3.0-3
python38-pip-wheel - update to 19.3.1-5
python38-pip - update to 19.3.1-5
python38-setuptools - update to 41.6.0-5
python38-setuptools-wheel - update to 41.6.0-5
python38-pytz - update to 2019.3-3

• https://github.com/python/cpython/pull/24297
• https://snyk.io/blog/cache-poisoning-in-popular-open-source-packages/
• https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933
• https://www.djangoproject.com/weblog/2021/feb/19/security-releases/

• Web cache poisoning in Django
• Arch Linux update for python-django
• Arch Linux update for python
• Arch Linux update for python2
• Red Hat Enterprise Linux 8 update for python3
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in Red Hat OpenShift Jaeger
• Multiple vulnerabilities in Red Hat Web Terminal
• Multiple vulnerabilities in Fortinet FortiAnalyzer
• Amazon Linux AMI update for python27
• Ubuntu update for python-django
• Multiple vulnerabilities in IBM Cloud Pak for Security
• SUSE update for python
• SUSE update for python
• SUSE update for python3
• SUSE update for python36
• SUSE update for python3
• Amazon Linux AMI update for python35
• Amazon Linux AMI update for python36
• Amazon Linux AMI update for python34
• Gentoo update for Python
• Multiple vulnerabilities in IBM QRadar SIEM
• Multiple vulnerabilities in Dell PowerStore Family
• Multiple vulnerabilities in Dell EMC Enterprise SONiC
• openEuler update for python3
• Multiple vulnerabilities in Dell SmartFabric OS10
• Multiple vulnerabilities in OpenShift Virtualization 4.8
• Multiple vulnerabilities in OpenShift Virtualization 2.6
• Red Hat Enterprise Linux 8 update for the python27:2.7 module
• Red Hat Enterprise Linux 8 update for the python38:3.8 and python38-devel:3.8 modules
• Fedora 35 update for python3.6
• Fedora 34 update for python3.6
• Fedora 33 update for python3.6
• Fedora 32 update for python36
• Fedora 33 update for python3.7
• Fedora 32 update for python37
• Fedora 32 update for python39
• Fedora 33 update for python3.8
• Fedora 32 update for python3
• Fedora 33 update for python3.9
• Fedora 33 update for python3.10
• Fedora 34 update for python3.10
• Fedora 32 update for python3.10
• Fedora 34 update for python-django
• Fedora 33 update for python-django
• Fedora 32 update for python-django
• Fedora EPEL 8 update for python-django
• Fedora 34 update for mingw-python3
• Fedora 33 update for mingw-python3
• Fedora 32 update for mingw-python3
• Fedora 32 update for python3, python3-docs
• Fedora 35 update for python2.7
• Fedora 33 update for python2.7
• Fedora 34 update for python2.7
• Fedora 38 update for python-django3
• Anolis OS update for python38:3.8 module
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge
• Multiple vulnerabilities in IBM Voice Gateway
• Multiple vulnerabilities in IBM Observability with Instana (Agent)