Input validation error in oauthlib - CVE-2022-36087

Vulnerability identifier: #VU67186

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2022-36087

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to insufficient validation of user-supplied input within uri_validate functions. A remote attacker can pass specially crafted input to the application and perform a denial of service (DoS) attack.

oauthlib
Oracle Linux
Anolis OS
Red Hat Enterprise Linux for x86_64
Red Hat Enterprise Linux for Power, little endian
Red Hat Enterprise Linux for IBM z Systems
Red Hat Enterprise Linux for ARM 64
openEuler
Ubuntu
Fedora
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
IBM Watson Discovery for IBM Cloud Pak for Data
Spectrum Discover
IBM Maximo Application Suite
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift
python3-oauthlib (Ubuntu package)
python3-oauthlib
python-oauthlib
python3-oauthlib+signedtoken
fence-agents (Red Hat package)
fence-agents-ilo2
fence-agents-lpar
fence-agents-ilo-ssh
fence-agents-ilo-mp
fence-agents-ilo-moonshot
fence-agents-ifmib
fence-agents-ibmblade
fence-agents-hpblade
fence-agents-heuristics-ping
fence-agents-eps
fence-agents-emerson
fence-agents-eaton-snmp
fence-agents-drac5
fence-agents-common
fence-agents-intelmodular
fence-agents-ipdu
fence-agents-ipmilan
fence-agents-vmware-soap
fence-agents-apc-snmp
fence-agents-wti
fence-agents-mpath
fence-agents-rhevm
fence-agents-rsa
fence-agents-rsb
fence-agents-sbd
fence-agents-scsi
fence-agents-virsh
fence-agents-vmware-rest
fence-agents-cisco-mds
fence-agents-all
fence-agents-kdump
fence-agents-redfish
fence-agents-compute
fence-virt
fence-virtd
fence-virtd-cpg
fence-virtd-libvirt
fence-virtd-serial
fence-virtd-tcp
fence-agents-amt-ws
fence-agents-apc
fence-virtd-multicast
fence-agents-bladecenter
fence-agents-brocade
fence-agents-cisco-ucs
Cloud Pak for Security (CP4S)
IBM Cloud Pak for Watson AIOps
IBM Watson Machine Learning Accelerator
Robotic Process Automation for Cloud Pak

Install updates from vendor's website.

oauthlib - update to 3.2.1
IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data - update to 4.8.0
IBM Watson Discovery for IBM Cloud Pak for Data - update to 4.6.0
python3-oauthlib (Ubuntu package) - update to 3.2.0-1ubuntu0.1
python3-oauthlib - update to 3.1.1-3
python-oauthlib - update to 3.1.1-3
python-oauthlib - addressed in versions 3.2.1-1.fc37, 3.2.2-1.fc37, 3.2.2-1.fc38, 3.2.2-1.fc39
python3-oauthlib - update to 3.2.2-1
python3-oauthlib+signedtoken - update to 3.2.2-1
fence-agents (Red Hat package) - update to 4.10.0-43.el9
fence-agents-ilo2 - update to 4.10.0-43.0.1
fence-agents-lpar - update to 4.10.0-43.0.1
fence-agents-ilo-ssh - update to 4.10.0-43.0.1
fence-agents-ilo-mp - update to 4.10.0-43.0.1
fence-agents-ilo-moonshot - update to 4.10.0-43.0.1
fence-agents-ifmib - update to 4.10.0-43.0.1
fence-agents-ibmblade - update to 4.10.0-43.0.1
fence-agents-hpblade - update to 4.10.0-43.0.1
fence-agents-heuristics-ping - update to 4.10.0-43.0.1
fence-agents-eps - update to 4.10.0-43.0.1
fence-agents-emerson - update to 4.10.0-43.0.1
fence-agents-eaton-snmp - update to 4.10.0-43.0.1
fence-agents-drac5 - update to 4.10.0-43.0.1
fence-agents-common - update to 4.10.0-43.0.1
fence-agents-intelmodular - update to 4.10.0-43.0.1
fence-agents-ipdu - update to 4.10.0-43.0.1
fence-agents-ipmilan - update to 4.10.0-43.0.1
fence-agents-vmware-soap - update to 4.10.0-43.0.1
fence-agents-apc-snmp - update to 4.10.0-43.0.1
fence-agents-wti - update to 4.10.0-43.0.1
fence-agents-mpath - update to 4.10.0-43.0.1
fence-agents-rhevm - update to 4.10.0-43.0.1
fence-agents-rsa - update to 4.10.0-43.0.1
fence-agents-rsb - update to 4.10.0-43.0.1
fence-agents-sbd - update to 4.10.0-43.0.1
fence-agents-scsi - update to 4.10.0-43.0.1
fence-agents-virsh - update to 4.10.0-43.0.1
fence-agents-vmware-rest - update to 4.10.0-43.0.1
fence-agents-cisco-mds - update to 4.10.0-43.0.1
fence-agents-all - update to 4.10.0-43.0.1
fence-agents-kdump - update to 4.10.0-43.0.1
fence-agents-redfish - update to 4.10.0-43.0.1
fence-agents-compute - update to 4.10.0-43.0.1
fence-virt - update to 4.10.0-43.0.1
fence-virtd - update to 4.10.0-43.0.1
fence-virtd-cpg - update to 4.10.0-43.0.1
fence-virtd-libvirt - update to 4.10.0-43.0.1
fence-virtd-serial - update to 4.10.0-43.0.1
fence-virtd-tcp - update to 4.10.0-43.0.1
fence-agents-amt-ws - update to 4.10.0-43.0.1
fence-agents-apc - update to 4.10.0-43.0.1
fence-virtd-multicast - update to 4.10.0-43.0.1
fence-agents-bladecenter - update to 4.10.0-43.0.1
fence-agents-brocade - update to 4.10.0-43.0.1
fence-agents-cisco-ucs - update to 4.10.0-43.0.1
Cloud Pak for Security (CP4S) - update to 1.10.10.0
Spectrum Discover - addressed in versions 2.0.4.8, 2.1.1
IBM Cloud Pak for Watson AIOps - update to 3.6.1
IBM Watson Machine Learning Accelerator - update to 4.0
IBM Maximo Application Suite - addressed in versions 8.8.6, 8.9.2
IBM Spectrum Protect Plus Container Backup and Restore for Kubernetes - update to 10.1.12.3
IBM Spectrum Protect Plus Container Backup and Restore for OpenShift - update to 10.1.12.3
Robotic Process Automation for Cloud Pak - update to 21.0.6

• https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py
• https://github.com/oauthlib/oauthlib/releases/tag/v3.2.1
• https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232
• https://github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7
• https://github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd

• Denial of service in oauthlib
• Ubuntu update for python-oauthlib
• Deial of service in Watson Discovery for IBM Cloud Pak for Data
• Input validation error in IBM Spectrum Protect Plus Container backup and restore for Kubernetes and OpenShift
• Multiple vulnerabilities in IBM Robotic Process Automation for Cloud Pak
• IBM Maximo Application Suite update for OAuthlib
• Red Hat Enterprise Linux 9 update for fence-agents
• Multiple vulnerabilities in Oracle Linux
• Multiple vulnerabilities in IBM Cloud Pak for Security (CP4S)
• Multiple vulnerabilities in IBM Spectrum Discover
• Multiple vulnerabilities in IBM Cloud Pak for Watson AIOps
• Fedora 39 update for python-oauthlib
• Fedora 37 update for python-oauthlib
• Fedora 38 update for python-oauthlib
• Multiple vulnerabilities in IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Watson Machine Learning Accelerator on Cloud Pak for Data
• openEuler 22.03 LTS update for python-oauthlib
• Fedora 37 update for python-oauthlib
• Anolis OS update for fence-agents
• Anolis OS update for python-oauthlib