Input validation error in oauthlib - CVE-2022-36087

Vulnerability identifier: #VU67186

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-36087

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within uri_validate functions. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

oauthlib
IBM Cloud Pak for Watson AIOps
IBM Watson Machine Learning Accelerator
Robotic Process Automation for Cloud Pak
Oracle Linux
Anolis OS
Red Hat Enterprise Linux for ARM 64
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
openEuler
Ubuntu
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Spectrum Discover
IBM Maximo Application Suite
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
Cloud Pak for Security (CP4S)
python3-oauthlib
python-oauthlib
python3-oauthlib (Ubuntu package)
python3-oauthlib+signedtoken
fence-agents (Red Hat package)
fence-agents-ipdu
fence-agents-emerson
fence-agents-eps
fence-agents-heuristics-ping
fence-agents-hpblade
fence-agents-ibmblade
fence-agents-ifmib
fence-agents-ilo-moonshot
fence-agents-ilo-mp
fence-agents-ilo-ssh
fence-agents-ilo2
fence-agents-intelmodular
fence-agents-wti
fence-agents-ipmilan
fence-agents-lpar
fence-agents-mpath
fence-agents-rhevm
fence-agents-rsa
fence-agents-rsb
fence-agents-sbd
fence-agents-scsi
fence-agents-virsh
fence-agents-vmware-rest
fence-agents-vmware-soap
fence-agents-drac5
fence-agents-all
fence-agents-kdump
fence-agents-redfish
fence-agents-compute
fence-virt
fence-virtd
fence-virtd-cpg
fence-virtd-libvirt
fence-virtd-multicast
fence-virtd-serial
fence-virtd-tcp
fence-agents-amt-ws
fence-agents-apc
fence-agents-apc-snmp
fence-agents-bladecenter
fence-agents-brocade
fence-agents-cisco-mds
fence-agents-cisco-ucs
fence-agents-common
fence-agents-eaton-snmp

Install updates from vendor's website.

oauthlib - update to 3.2.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.0
Cloud Pak for Security (CP4S) - update to 1.10.10.0
Spectrum Discover - addressed in versions 2.0.4.8, 2.1.1
python3-oauthlib - update to 3.1.1-3
python-oauthlib - update to 3.1.1-3
python3-oauthlib (Ubuntu package) - update to 3.2.0-1ubuntu0.1
python-oauthlib - addressed in versions 3.2.1-1.fc37, 3.2.2-1.fc37, 3.2.2-1.fc38, 3.2.2-1.fc39
python3-oauthlib - update to 3.2.2-1
python3-oauthlib+signedtoken - update to 3.2.2-1
IBM Cloud Pak for Watson AIOps - update to 3.6.1
IBM Watson Machine Learning Accelerator - update to 4.0
fence-agents (Red Hat package) - update to 4.10.0-43.el9
fence-agents-ipdu - update to 4.10.0-43.0.1
fence-agents-emerson - update to 4.10.0-43.0.1
fence-agents-eps - update to 4.10.0-43.0.1
fence-agents-heuristics-ping - update to 4.10.0-43.0.1
fence-agents-hpblade - update to 4.10.0-43.0.1
fence-agents-ibmblade - update to 4.10.0-43.0.1
fence-agents-ifmib - update to 4.10.0-43.0.1
fence-agents-ilo-moonshot - update to 4.10.0-43.0.1
fence-agents-ilo-mp - update to 4.10.0-43.0.1
fence-agents-ilo-ssh - update to 4.10.0-43.0.1
fence-agents-ilo2 - update to 4.10.0-43.0.1
fence-agents-intelmodular - update to 4.10.0-43.0.1
fence-agents-wti - update to 4.10.0-43.0.1
fence-agents-ipmilan - update to 4.10.0-43.0.1
fence-agents-lpar - update to 4.10.0-43.0.1
fence-agents-mpath - update to 4.10.0-43.0.1
fence-agents-rhevm - update to 4.10.0-43.0.1
fence-agents-rsa - update to 4.10.0-43.0.1
fence-agents-rsb - update to 4.10.0-43.0.1
fence-agents-sbd - update to 4.10.0-43.0.1
fence-agents-scsi - update to 4.10.0-43.0.1
fence-agents-virsh - update to 4.10.0-43.0.1
fence-agents-vmware-rest - update to 4.10.0-43.0.1
fence-agents-vmware-soap - update to 4.10.0-43.0.1
fence-agents-drac5 - update to 4.10.0-43.0.1
fence-agents-all - update to 4.10.0-43.0.1
fence-agents-kdump - update to 4.10.0-43.0.1
fence-agents-redfish - update to 4.10.0-43.0.1
fence-agents-compute - update to 4.10.0-43.0.1
fence-virt - update to 4.10.0-43.0.1
fence-virtd - update to 4.10.0-43.0.1
fence-virtd-cpg - update to 4.10.0-43.0.1
fence-virtd-libvirt - update to 4.10.0-43.0.1
fence-virtd-multicast - update to 4.10.0-43.0.1
fence-virtd-serial - update to 4.10.0-43.0.1
fence-virtd-tcp - update to 4.10.0-43.0.1
fence-agents-amt-ws - update to 4.10.0-43.0.1
fence-agents-apc - update to 4.10.0-43.0.1
fence-agents-apc-snmp - update to 4.10.0-43.0.1
fence-agents-bladecenter - update to 4.10.0-43.0.1
fence-agents-brocade - update to 4.10.0-43.0.1
fence-agents-cisco-mds - update to 4.10.0-43.0.1
fence-agents-cisco-ucs - update to 4.10.0-43.0.1
fence-agents-common - update to 4.10.0-43.0.1
fence-agents-eaton-snmp - update to 4.10.0-43.0.1
IBM Maximo Application Suite - addressed in versions 8.8.6, 8.9.2
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.12.3
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.12.3
Robotic Process Automation for Cloud Pak - update to 21.0.6

• https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py
• https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1
• https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232
• https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7
• https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd

• Denial of service in oauthlib
• Ubuntu update for python-oauthlib
• Deial of service in Watson Discovery for IBM Cloud Pak for Data
• Input validation error in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• IBM Maximo Application Suite update for OAuthlib
• Red Hat Enterprise Linux 9 update for fence-agents
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Spectrum Discover
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Fedora 39 update for python-oauthlib
• Fedora 37 update for python-oauthlib
• Fedora 38 update for python-oauthlib
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler 22.03 LTS update for python-oauthlib
• Fedora 37 update for python-oauthlib
• Anolis OS update for fence-agents
• Anolis OS update for python-oauthlib