CVE-2022-36087

2022-09-0900:00:00

ubuntu.com

oauthlib;python 3.6+;denial of service;malicious redirect uri;uri validation

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

NONE

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

EPSS

0.003

Percentile

68.0%

JSON

OAuthLib is an implementation of the OAuth request-signing logic for Python
3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing
malicious redirect uri can cause denial of service. An attacker can also
leverage usage of uri_validate functions depending where it is used.
OAuthLib applications using OAuth2.0 provider support or use directly
uri_validate are affected by this issue. Version 3.2.1 contains a patch.
There are no known workarounds.

Bugs

<https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1019710>

Notes

Author	Note
mdeslaur	issue introduced in 3.1.1

OSVersionArchitecturePackageVersionFilename
ubuntu22.04noarchpython-oauthlib< 3.2.0-1ubuntu0.1UNKNOWN
ubuntu22.10noarchpython-oauthlib< 3.2.0-1ubuntu1UNKNOWN