CVE-2022-36087 — Improper Input Validation

Vendor	Product	Version range	Fixed in
debian	python-oauthlib	< python-oauthlib 3.2.1-1 (bookworm)	python-oauthlib 3.2.1-1 (bookworm)
fedoraproject	fedora	—	—
oauthlib	oauthlib	—	—
oauthlib	oauthlib	>= 3.1.1 < 3.2.2	3.2.2
oauthlib_project	oauthlib	>= 3.1.1 < 3.2.1	3.2.1

OSV

OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI

osv·2022-09-16

CVE-2022-36087 [MEDIUM] OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI ### Impact - Attacker providing malicious redirect uri can cause DoS to oauthlib's web application. - Attacker can also leverage usage of `uri_validate` functions depending where it is used. _What kind of vulnerability is it? Who is impacted?_ Oauthlib applications using OAuth2.0 provider support or use directly `uri_validate` function. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Issue fixed in 3.2.2 release. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ The `redirect_uri` can be verified in web toolkit (i.e `bottle-oauthlib`, `django-oauth-toolkit`, ...) before oauthlib is called. A sample check if `:` is present to reject

GHSA

OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI

ghsa·2022-09-16

CVE-2022-36087 [MEDIUM] CWE-20 OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI ### Impact - Attacker providing malicious redirect uri can cause DoS to oauthlib's web application. - Attacker can also leverage usage of `uri_validate` functions depending where it is used. _What kind of vulnerability is it? Who is impacted?_ Oauthlib applications using OAuth2.0 provider support or use directly `uri_validate` function. ### Patches _Has the problem been patched? What versions should users upgrade to?_ Issue fixed in 3.2.2 release. ### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_ The `redirect_uri` can be verified in web toolkit (i.e `bottle-oauthlib`, `django-oauth-toolkit`, ...) before oauthlib is called. A sample check if `:` is present to reject

OSV

CVE-2022-36087: OAuthLib is an implementation of the OAuth request-signing logic for Python 3

osv·2022-09-09·CVSS 6.5

CVE-2022-36087 [MEDIUM] CVE-2022-36087: OAuthLib is an implementation of the OAuth request-signing logic for Python 3 OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.

Ubuntu

OAuthLib vulnerability

vendor_ubuntu·2022-09-22

CVE-2022-36087 OAuthLib vulnerability Title: OAuthLib vulnerability Summary: OAuthLib could be made to crash if it received specially crafted network traffic. Sebastian Chnelik discovered that OAuthLib incorrectly handled certain redirect uris. A remote attacker could possibly use this issue to cause OAuthLib to crash, resulting in a denial of service. Instructions: In general, a standard system update will make all the necessary changes.

Red Hat

python-oauthlib: DoS when attacker provides malicious IPV6 URI

vendor_redhat·2022-09-09·CVSS 5.7

CVE-2022-36087 [MEDIUM] CWE-601 python-oauthlib: DoS when attacker provides malicious IPV6 URI python-oauthlib: DoS when attacker provides malicious IPV6 URI OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds. A flaw was found in python-oauthlib. This flaw allows an attacker providing a malicious redirect URI to cause a denial of service to OAuthLib's web application. Mitigation: The redirect_uri can be verified in the web toolkit before OAuthLib is called. Check to see if `

Debian

CVE-2022-36087: python-oauthlib - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+...

vendor_debian·2022·CVSS 5.7

CVE-2022-36087 [MEDIUM] CVE-2022-36087: python-oauthlib - OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+... OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds. Scope: local bookworm: resolved (fixed in 3.2.1-1) bullseye: resolved forky: resolved (fixed in 3.2.1-1) sid: resolved (fixed in 3.2.1-1) trixie: resolved (fixed in 3.2.1-1)

CVE-2022-36087: OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious…

Affected

CVSS provenance