CVE-2022-48566 CVE-2023-24329 CVE-2023-40217
This update fixes multiple vulnerabilities concerning the urlparse module as well as vulnerabilities concerning the heapq, hmac, plistlib and ssl modules.
CVE-2021-23336
Python was vulnerable to Web Cache Poisoning via urlparse.parse_qsl and
urlparse.parse_qs by using a vector called parameter cloaking. When the
attacker can separate query parameters using a semicolon (;), they can
cause a difference in the interpretation of the request between the proxy
(running with default configuration) and the server. This can result in
malicious requests being cached as completely safe ones, as the proxy would
usually not see the semicolon as a separator, and therefore would not
include it in a cache key of an unkeyed parameter.
CVE-2022-0391
The urlparse module helps break Uniform Resource Locator (URL) strings into
components. The issue involves how the urlparse method does not sanitize
input and allows characters like '\r' and '\n' in the URL path. This flaw
allows an attacker to input a crafted URL, leading to injection attacks.
CVE-2022-48560
A use-after-free exists in Python via heappushpop in heapq.
CVE-2022-48565
An XML External Entity (XXE) issue was discovered in Python. The plistlib
module no longer accepts entity declarations in XML plist files to avoid
XML vulnerabilities.
CVE-2022-48566
An issue was discovered in compare_digest in Lib/hmac.py in Python.
Constant-time-defeating optimisations were possible in the accumulator
variable in hmac.compare_digest.
CVE-2023-24329
An issue in the urlparse component of Python allows attackers to bypass
blocklisting methods by supplying a URL that starts with blank characters.
CVE-2023-40217
The issue primarily affects servers written in Python (such as HTTP
servers) that use TLS client authentication. If a TLS server-side socket is
created, receives data into the...
2.7.16-2+deb10u3