p PatchFirst

CVE-2022-36087

CVE-2022-36087 · OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI

This page contains facts from public vulnerability sources. Check the original advisory before updating.

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.

CVSS 5.7 · Medium · EPSS 1.7% · Fix available

Published
Updated

Stack: system · python

Affected products and versions

  • oauthlib

    Versions
    • >= 3.1.1, < 3.2.1: Affected

    No fix published

  • python-oauthlib Debian:12

    Affected ranges
    • ECOSYSTEM: < 3.2.1-1

    Update to 3.2.1-1

  • python-oauthlib Debian:13

    Affected ranges
    • ECOSYSTEM: < 3.2.1-1

    Update to 3.2.1-1

  • python-oauthlib Debian:14

    Affected ranges
    • ECOSYSTEM: < 3.2.1-1

    Update to 3.2.1-1

  • oauthlib PyPI

    Versions
    • 3.1.1
    • 3.2.0
    • 3.2.1
    Affected ranges
    • ECOSYSTEM: ≥ 3.1.1, < 3.2.2

    Update to 3.2.2

  • oauthlib PyPI

    Versions
    • 3.1.1
    • 3.2.0
    Affected ranges
    • GIT: < 2e40b412c844ecc4673c3fa3f72181f228bdbacd
    • ECOSYSTEM: ≥ 3.1.1, < 3.2.1

    Update to 3.2.1

  • python-oauthlib Ubuntu:22.04:LTS

    Versions
    • 3.1.0-2
    • 3.1.1-1
    • 3.2.0-1
    Affected ranges
    • ECOSYSTEM: < 3.2.0-1ubuntu0.1

    Update to 3.2.0-1ubuntu0.1

Original sources

Check your server →