CVE-2021-23336

一、漏洞信息
 漏洞编号：[CVE-2021-23336](https://nvd.nist.gov/vuln/detail/CVE-2021-23336)
 漏洞归属组件：python2
 漏洞归属的版本：2.7.16
 CVSS V3.0分值：
  BaseScore：7.1 High
  Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
 漏洞简述：
  The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.
 漏洞公开时间：2021-02-15
 漏洞创建时间：2021-05-13 14:34:09
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2021-23336
 漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/doc/md/manual.md
二、漏洞分析结构反馈
 影响性分析说明：
     
 openEuler评分：
  7.1
 Vector：CVSS：3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:H
 受影响版本排查(受影响/不受影响)：
  1.openEuler-20.03-LTS:
2.openEuler-20.09:

cve-test/python2

内容风险标识

评论 (7)

cve-test/python2 .gitee-modal { width: 500px !important; }

内容风险标识

CVE-2021-23336

评论 (7)

搜索帮助

cve-test/python2