CVE-2021-23336: python before 3.6.13 (exclusive), from 3.7.0 (inclusive), before 3.7.10 (exclusive), from 3.8.0 (inclusive), before…

Affected technology

python · before 3.6.13 (exclusive)
python

python · from 3.7.0 (inclusive), before 3.7.10 (exclusive)
python

python · from 3.8.0 (inclusive), before 3.8.8 (exclusive)
python

python · from 3.9.0 (inclusive), before 3.9.2 (exclusive)
python

fedora · 32
fedoraproject

fedora · 33
fedoraproject

fedora · 34
fedoraproject

debian linux · 9.0
debian

cloud backup · Version not applicable in the source CPE
netapp

inventory collect tool · Version not applicable in the source CPE
netapp

ontap select deploy administration utility · Version not applicable in the source CPE
netapp

snapcenter · Version not applicable in the source CPE
netapp

django · from 2.2 (inclusive), before 2.2.19 (exclusive)
djangoproject

django · from 3.0 (inclusive), before 3.0.13 (exclusive)
djangoproject

django · from 3.1 (inclusive), before 3.1.7 (exclusive)
djangoproject

communications offline mediation controller · 12.0.0.3.0
oracle

communications pricing design center · 12.0.0.3.0
oracle

enterprise manager ops center · 12.4.0.0
oracle

zfs storage appliance · 8.8
oracle

python/cpython · 0 to before unspecified, unspecified to before 3.6.13, 3.7.0 to before unspecified, unspecified to before 3.7.10, 3.8.0 to before unspecified, unspecified to before 3.8.8, 3.9.0 to before unspecified, unspecified to before 3.9.2
Vendor not specified by the source

SIMATIC S7-1500 CPU 1518-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

SIPLUS S7-1500 CPU 1518-4 PN/DP MFP · V3.1.0 to before V3.1.5
Siemens

Description’s affected range: before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

Attack conditions (NVD, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. Vendor/CNA’s CVSS 3.1 assessment (base score 5.9/10) rates confidentiality impact as none; integrity impact as low; availability impact as high. NVD’s CVSS 3.1 assessment (base score 5.9/10) rates confidentiality impact as none; integrity impact as low; availability impact as high.