CVE-2022-36087: OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI
(updated )
- Attacker providing malicious redirect uri can cause DoS to oauthlib’s web application.
- Attacker can also leverage usage of
uri_validatefunctions depending where it is used.
What kind of vulnerability is it? Who is impacted?
Oauthlib applications using OAuth2.0 provider support or use directly uri_validate function.
References
- github.com/advisories/GHSA-3pgj-pg6c-r5p7
- github.com/oauthlib/oauthlib
- github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py
- github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py
- github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacd
- github.com/oauthlib/oauthlib/releases/tag/v3.2.1
- github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7
- github.com/pypa/advisory-database/tree/main/vulns/oauthlib/PYSEC-2022-269.yaml
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LXOPIA6M57CFQPUT6HHSNXCTV6QA3UDI
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NBCQJR3ZF7FVNTJYRVPVSQEQRAYZIUHU
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QRYLYHE5HWF6R2CRLJFUK4PILR47WXOE
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X2CQZM5CKOUM4GW2GTAPQEQFPITQ6F7S
- nvd.nist.gov/vuln/detail/CVE-2022-36087
Code Behaviors & Features
Detect and mitigate CVE-2022-36087 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →