Web Cache Poisoning
Priority MEDIUM 54CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- Required
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · High
- Fix status
- Partial Red Hat: 6 fixed, 9 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and Red Hat.
Summary
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.40736 98th percentileScored 2026-11-07
Fix Partial python/cpython: 3.6.13, 3.7.10, 3.8.8 +1Red Hat: 5 advisoriesRed Hat: 6 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | python/cpython | all versions; before 3.6.13; 3.7.0 and later; before 3.7.10; 3.8.0 and later; before 3.8.8; 3.9.0 and later; before 3.9.2 | 3.6.13, 3.7.10, 3.8.8, 3.9.2 | Patch available | CNA |
- python/cpython Vendor— Affected all versions; before 3.6.13; 3.7.0 and later; before 3.7.10; 3.8.0 and later; before 3.8.8; 3.9.0 and later; before 3.9.2 Fixed in 3.6.13, 3.7.10, 3.8.8, 3.9.2 Patch available CNA
CPE configurations NVD · 14
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:python:python:*:*:*:*:*:*:*:* | before 3.6.13; 3.7.0 to before 3.7.10; 3.8.0 to before 3.8.8; 3.9.0 to before 3.9.2 | Vulnerable | python-pillow |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* | 33 | Vulnerable | Fedoraproject |
| cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* | 34 | Vulnerable | Fedoraproject |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:inventory_collect_tool:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* | 2.2 to before 2.2.19; 3.0 to before 3.0.13; 3.1 to before 3.1.7 | Vulnerable | djangoproject |
- cpe:2.3:a:python:python:*:*:*:*:*:*:*:* Versions before 3.6.13; 3.7.0 to before 3.7.10; 3.8.0 to before 3.8.8; 3.9.0 to before 3.9.2 Vulnerable ·python-pillow
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* Versions 33 Vulnerable ·Fedoraproject
- cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* Versions 34 Vulnerable ·Fedoraproject
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:cloud_backup:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:inventory_collect_tool:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:ontap_select_deploy_administration_utility:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:djangoproject:django:*:*:*:*:*:*:*:* Versions 2.2 to before 2.2.19; 3.0 to before 3.0.13; 3.1 to before 3.1.7 Vulnerable ·djangoproject
Show 4 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:* | 12.0.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* | 12.0.0.3.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* | 12.4.0.0 | Vulnerable | Oracle |
| cpe:2.3:o:oracle:zfs_storage_appliance:8.8:*:*:*:*:*:*:* | 8.8 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:* Versions 12.4.0.0 Vulnerable ·Oracle
- cpe:2.3:o:oracle:zfs_storage_appliance:8.8:*:*:*:*:*:*:* Versions 8.8 Vulnerable ·Oracle
Remediation
- Fix · CNA python/cpython Fixed in 3.6.13, 3.7.10, 3.8.8, 3.9.2
Red Hat 5 advisories
- RHSA-2021:4162 Released 2021-11-09 · Red Hat rating Moderatepython38:3.8 and python38-devel:3.8 security update
- Red Hat CodeReady Linux Builder (v. 8) pytest-4.6.6-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-atomicwrites-1.3.0-8.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8, python-attrs-19.3.0-3.module+el8.4.0+8888+89bc7e79.src::python38-devel:3.8 +15
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.29.14-4.module+el8.4.0+8888+89bc7e79.src::python38:3.8, PyYAML-5.4.1-1.module+el8.5.0+10721+14d8e0d5.src::python38:3.8, babel-2.7.0-11.module+el8.5.0+11015+9c1c7c42.src::python38:3.8 +47
- RHSA-2021:4151 Released 2021-11-09 · Red Hat rating Moderatepython27:2.7 security update
- Red Hat Enterprise Linux AppStream (v. 8) Cython-0.28.1-7.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, PyYAML-3.12-16.module+el8.1.0+3111+de3f2d8e.src::python27:2.7, babel-2.5.1-10.module+el8.5.0+11014+88fc0d0b.noarch::python27:2.7 +47
- RHSA-2021:3252 Released 2021-08-24 · Red Hat rating Moderatepython27 security update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-babel-0.9.6-10.el7, python27-python-2.7.18-3.el7, python27-python-babel-0.9.6-10.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) python27-babel-0.9.6-10.el7, python27-python-2.7.18-3.el7, python27-python-babel-0.9.6-10.el7 +8
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-babel-0.9.6-10.el7, python27-python-2.7.18-3.el7, python27-python-babel-0.9.6-10.el7 +8
Show 2 more Red Hat advisories
- RHSA-2021:3254 Released 2021-08-24 · Red Hat rating Moderaterh-python38 security, bug fix, and enhancement update
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-python38-babel-2.7.0-12.el7, rh-python38-python-3.8.11-2.el7, rh-python38-python-babel-2.7.0-12.el7 +14
- RHSA-2021:1633 Released 2021-05-18 · Red Hat rating Moderatepython3 security update
- Red Hat Enterprise Linux AppStream (v. 8) platform-python-3.6.8-37.el8, platform-python-debug-3.6.8-37.el8, platform-python-devel-3.6.8-37.el8 +3
- Red Hat Enterprise Linux BaseOS (v. 8) platform-python-3.6.8-37.el8, python3-3.6.8-37.el8, python3-libs-3.6.8-37.el8 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Ceph Storage 2 | Affected | No fix planned: Out of support scope |
| Red Hat Ceph Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 10 (Newton) | Affected | No fix planned: Out of support scope |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 16.1 | Affected | No fix planned: Will not fix |
| Red Hat Storage 3 | Affected | No fix planned: Will not fix |
| Red Hat Update Infrastructure 3 for Cloud Providers | Affected | No fix planned: Will not fix |
| Red Hat CodeReady Linux Builder (v. 8) | Fixed | RHSA-2021:4162 |
| Red Hat Enterprise Linux AppStream (v. 8) | Fixed | RHSA-2021:1633, RHSA-2021:4151, RHSA-2021:4162 |
| Red Hat Enterprise Linux BaseOS (v. 8) | Fixed | RHSA-2021:1633 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) | Fixed | RHSA-2021:3252, RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) | Fixed | RHSA-2021:3252, RHSA-2021:3254 |
| Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) | Fixed | RHSA-2021:3252, RHSA-2021:3254 |
Not affected: 3 products
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat Satellite 6
Timeline
- 2026-10-02 Threatist record created from CVE-2021-23336
- 2026-10-03 Alias added: GHSA-4qjw-vx62-3vqx
References
Patch 6
- https://github.com/python/cpython/pull/24297
- [oss-security] 20210219 Django security releases: CVE-2021-23336: Web cache poisoning via ``django.utils.http.limited_parse_qsl()``
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpuoct2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
Advisory 25
- [debian-lts-announce] 20210219 [SECURITY] [DLA 2569-1] python-django security update
- FEDORA-2021-7547ad987f
- FEDORA-2021-f4fd9372c7
- FEDORA-2021-3352c1c802
- FEDORA-2021-7d3a9004e2
- FEDORA-2021-907f3bacae
- FEDORA-2021-7c1bb32d13
- FEDORA-2021-b1843407ca
- FEDORA-2021-2897f5366c
- FEDORA-2021-b326fcb83f
- FEDORA-2021-1bb399a5af
- FEDORA-2021-ef83e8525a
- FEDORA-2021-b76ede8f4d
- FEDORA-2021-309bc2e727
- FEDORA-2021-5a09621ebb
- FEDORA-2021-e22bb0e548
- FEDORA-2021-e525e48886
- [debian-lts-announce] 20210405 [SECURITY] [DLA 2619-1] python3.5 security update
- [debian-lts-announce] 20210417 [SECURITY] [DLA 2628-1] python2.7 security update
- FEDORA-2021-b6b6093b3a
- GLSA-202104-04
- [oss-security] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL
- FEDORA-2021-98720f3785
- FEDORA-2021-12df7f7382
- https://security.netapp.com/advisory/ntap-20210326-0004/
Other 4
- [mina-dev] 20210225 [jira] [Created] (FTPSERVER-500) Security vulnerability in common/lib/log4j-1.2.17.jar
- [airflow-users] 20210501 CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL
- [announce] 20210501 Apache Airflow CVE: CVE-2021-28359: Apache Airflow Reflected XSS via Origin Query Argument in URL
- [debian-lts-announce] 20230920 [SECURITY] [DLA 3575-1] python2.7 security update
Sources
- CVE-2021-23336 · CVE Program
- CVE-2021-23336 · NVD
- FIRST EPSS
- GHSA-4qjw-vx62-3vqx · GitHub Advisory Database · CC BY 4.0
- CVE-2021-23336 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences