CVE-2022-36087: OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI

(updated )

  • Attacker providing malicious redirect uri can cause DoS to oauthlib’s web application.
  • Attacker can also leverage usage of uri_validate functions depending where it is used.

What kind of vulnerability is it? Who is impacted?

Oauthlib applications using OAuth2.0 provider support or use directly uri_validate function.

References

Code Behaviors & Features

Detect and mitigate CVE-2022-36087 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →