diff options
| author |   Lee Chee Yang <chee.yang.lee@intel.com> | 2021-06-15 09:21:31 -0700 |
|---|---|---|
| committer |   Steve Sakoman <steve@sakoman.com> | 2021-06-15 06:37:17 -1000 |
| commit | 8a59c47ce4c101b2470a06ecf101ca5ab7d1f82e (patch) | |
| tree | af596bcc20e69d7e58e73ac10695c2c4d2ef33bf /meta/recipes-devtools/python/python3_3.8.2.bb | |
| parent | 4de0d54827bc4645b69e5a0043b6f285b0193402 (diff) | |
| download | openembedded-core-contrib-8a59c47ce4c101b2470a06ecf101ca5ab7d1f82e.tar.gz | |
python3: fix CVE-2021-23336
The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before
3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable
to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by
using a vector called parameter cloaking. When the attacker can separate query
parameters using a semicolon (;), they can cause a difference in the
interpretation of the request between the proxy (running with default
configuration) and the server. This can result in malicious requests being
cached as completely safe ones, as the proxy would usually not see the
semicolon as a separator, and therefore would not include it in a cache key of
an unkeyed parameter.
References:
https://nvd.nist.gov/vuln/detail/CVE-2021-23336
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Tim Orling <timothy.t.orling@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta/recipes-devtools/python/python3_3.8.2.bb')
| -rw-r--r-- | meta/recipes-devtools/python/python3_3.8.2.bb | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/meta/recipes-devtools/python/python3_3.8.2.bb b/meta/recipes-devtools/python/python3_3.8.2.bb index 072ce97472..762e9444b8 100644 --- a/meta/recipes-devtools/python/python3_3.8.2.bb +++ b/meta/recipes-devtools/python/python3_3.8.2.bb @@ -39,6 +39,7 @@ SRC_URI = "http://www.python.org/ftp/python/${PV}/Python-${PV}.tar.xz \ file://CVE-2020-26116.patch \ file://CVE-2020-27619.patch \ file://CVE-2021-3177.patch \ + file://CVE-2021-23336.patch \ " SRC_URI_append_class-native = " \ |