Bug 28408 - python, python3 new security issue CVE-2021-23336
Summary: python, python3 new security issue CVE-2021-23336
Status: RESOLVED FIXED
Alias: None
Product: Mageia
Classification: Unclassified
Component: Security (show other bugs)
Version: 8
Hardware: All Linux
Priority: Normal normal
Target Milestone: ---
Assignee: QA Team
QA Contact: Sec team
URL:
Whiteboard: MGA7TOO MGA7-64-OK MGA8-64-OK MGA7-32...
Keywords: advisory, validated_update
Depends on:
Blocks:
 
Reported: 2021-02-23 02:14 CET by David Walser
Modified: 2021-04-02 12:17 CEST (History)
7 users (show)

See Also:
Source RPM: python3-3.8.7-1.mga8.src.rpm python-2.7.18-6.mga8.src.rpm
CVE:
Status comment:


Attachments

Description David Walser 2021-02-23 02:14:38 CET
Python 3.7.10 and 3.8.8 have been released on February 15 and 19:
https://blog.python.org/2021/02/python-3710-and-3613-security-updates.html
https://blog.python.org/2021/02/python-392-and-388-are-now-available.html

We already fixed CVE-2021-3177 in Bug 28204.

Mageia 7 is also affected.
David Walser 2021-02-23 02:14:46 CET

Whiteboard: (none) => MGA8TOO, MGA7TOO

Comment 1 Aurelien Oudelet 2021-02-23 18:19:24 CET
Hi, thanks for reporting this.
Assigned to the package maintainer.

(Please set the status to 'assigned' if you are working on it)

Assignee: bugsquad => python
CC: (none) => ouaurelien
Source RPM: python3-3.8.7-1.mga8.src.rpm, python-2.7.18-6.mga8.src.rpm => python3-3.8.7-1.mga8.src.rpm python-2.7.18-6.mga8.src.rpm

Comment 2 David Walser 2021-02-25 21:59:59 CET
python3-3.8.8-1.mga9 uploaded for Cauldron by Jani.

CC: (none) => jani.valimaa

Comment 3 David Walser 2021-02-25 22:04:42 CET
Jani has also built a python3 update for Mageia 7 and Mageia 8, python update still needed.

python3-3.7.10-1.mga7
libpython3.7-3.7.10-1.mga7
libpython3.7-stdlib-3.7.10-1.mga7
libpython3.7-testsuite-3.7.10-1.mga7
libpython3-devel-3.7.10-1.mga7
python3-docs-3.7.10-1.mga7
tkinter3-3.7.10-1.mga7
tkinter3-apps-3.7.10-1.mga7
python3-3.8.8-1.mga8
libpython3.8-stdlib-3.8.8-1.mga8
libpython3.8-3.8.8-1.mga8
libpython3-devel-3.8.8-1.mga8
tkinter3-apps-3.8.8-1.mga8
tkinter3-3.8.8-1.mga8
libpython3.8-testsuite-3.8.8-1.mga8
python3-docs-3.8.8-1.mga8
Comment 4 David Walser 2021-02-27 19:51:24 CET
Fedora has issued an advisory for python3 on February 20:
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/NODWHDIFBQE5RU5PUWUVE47JOT5VCMJ2/
Comment 5 David Walser 2021-02-27 20:15:31 CET
and on February 24 (previous was 3.7, this is 3.8):
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
Comment 6 Nicolas Lécureuil 2021-03-04 22:06:09 CET
Fixed in mga9

Pushed in mga7/8

src:
    - python-2.7.18-1.3.mga7
    - python-2.7.18-7.1.mga8

Assignee: python => qa-bugs
CC: (none) => mageia

Aurelien Oudelet 2021-03-04 22:14:22 CET

Version: Cauldron => 8

Comment 7 David Walser 2021-03-04 22:45:28 CET
Python 2 RPMs (Python 3 in Comment 3):
python-2.7.18-1.3.mga7
libpython2.7-2.7.18-1.3.mga7
libpython2.7-stdlib-2.7.18-1.3.mga7
libpython2.7-testsuite-2.7.18-1.3.mga7
libpython-devel-2.7.18-1.3.mga7
python-docs-2.7.18-1.3.mga7
tkinter-2.7.18-1.3.mga7
tkinter-apps-2.7.18-1.3.mga7
python-2.7.18-7.1.mga8
tkinter-apps-2.7.18-7.1.mga8
libpython2.7-testsuite-2.7.18-7.1.mga8
python-docs-2.7.18-7.1.mga8
libpython2.7-2.7.18-7.1.mga8
libpython2.7-stdlib-2.7.18-7.1.mga8
libpython-devel-2.7.18-7.1.mga8
tkinter-2.7.18-7.1.mga8

Whiteboard: MGA8TOO, MGA7TOO => MGA7TOO

Comment 8 David Walser 2021-03-05 00:51:50 CET
Advisory:
========================

Updated python and python3 packages fix security vulnerability:

The package python/cpython is vulnerable to Web Cache Poisoning via
urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called
parameter cloaking. When the attacker can separate query parameters using a
semicolon (;), they can cause a difference in the interpretation of the request
between the proxy (running with default configuration) and the server. This can
result in malicious requests being cached as completely safe ones, as the proxy
would usually not see the semicolon as a separator, and therefore would not
include it in a cache key of an unkeyed parameter (CVE-2021-23336).

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23336
https://blog.python.org/2021/02/python-392-and-388-are-now-available.html
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/thread/MNUN5SOMFL2BBKP6ZAICIIUPQKZDMGYO/
Comment 9 Herman Viaene 2021-03-23 11:32:23 CET
Using QARepo with the list of Comment 7, I seem to miss the python-2.7.18-1.3.mga7 and lib64python-devel-2.7.18-1.3.mga7 packages.

CC: (none) => herman.viaene

Comment 10 Len Lawrence 2021-03-24 10:21:31 CET
mga8, x64

CVE-2021-23336
https://bugs.python.org/issue42967
Simple test, before update:

$ python
>>> import urllib
>>> import urllib.parse
>>> urllib.parse.parse_qsl("a=1&b=2&c=3")
[('a', '1'), ('b', '2'), ('c', '3')]
>>> urllib.parse.parse_qsl("a=1&b=2;c=3")
[('a', '1'), ('b', '2;c=3')]
>>> exit()

Could not figure out how to use urllib in python2:
>>> import urllib.parse
Traceback (most recent call last):
  File "<stdin>", line 1, in <module>
ImportError: No module named parse

CC: (none) => tarazed25

Comment 11 Len Lawrence 2021-03-24 10:37:54 CET
It is called urlparse in python2.
Comment 12 Len Lawrence 2021-03-24 10:46:38 CET
$ python2
>>> import urlparse
>>> urlparse.parse_qsl("a=1&b=2&c=3")
[('a', '1'), ('b', '2'), ('c', '3')]
>>> urlparse.parse_qsl("a=1&b=2;c=3")
[('a', '1'), ('b', '2'), ('c', '3')]

So the issue had been fixed in python3 before the update but not in python2.
Comment 13 Len Lawrence 2021-03-24 11:24:51 CET
Updating:
- lib64python-devel-2.7.18-7.1.mga8.x86_64
- lib64python2.7-2.7.18-7.1.mga8.x86_64
- lib64python2.7-stdlib-2.7.18-7.1.mga8.x86_64
- lib64python2.7-testsuite-2.7.18-7.1.mga8.x86_64
- lib64python3-devel-3.8.8-1.mga8.x86_64
- lib64python3.8-3.8.8-1.mga8.x86_64
- lib64python3.8-stdlib-3.8.8-1.mga8.x86_64
- lib64python3.8-testsuite-3.8.8-1.mga8.x86_64
- python-2.7.18-7.1.mga8.x86_64
- python3-3.8.8-1.mga8.x86_64
- python3-docs-3.8.8-1.mga8.noarch
- tkinter-2.7.18-7.1.mga8.x86_64
- tkinter-apps-2.7.18-7.1.mga8.x86_64
- tkinter3-3.8.8-1.mga8.x86_64
- tkinter3-apps-3.8.8-1.mga8.x86_64

Ran tests again:
$ python
>>> urllib.parse.parse_qsl("a=1&b=2;c=3")
[('a', '1'), ('b', '2;c=3')]

$ python2
>>> urlparse.parse_qsl("a=1&b=2;c=3")
[('a', '1'), ('b', '2;c=3')]

The issue is fixed in both versions of python for Mageia 8.

Going to pass this on the basis of successful bugfix and clean install.

Whiteboard: MGA7TOO => MGA7TOO MGA8-64-OK

Comment 14 Len Lawrence 2021-03-31 11:15:30 CEST
mga7, x64

In Mageia 7 python2.7 is the default so python is used and python3 needs to be used for python3.7.
Installed the packages listed, ran the simple interactive session tests to demonstrate the fault.

Updated all the packages then ran the tests again.  These showed that the vulnerability had been eliminated.
$ python
Python 2.7.18 (default, Mar  4 2021, 21:08:30) 
[GCC 8.4.0] on linux2
Type "help", "copyright", "credits" or "license" for more information.
>>> import urlparse
>>> urlparse.parse_qsl("a=1&b=2&c=3")
[('a', '1'), ('b', '2'), ('c', '3')]
>>> urlparse.parse_qsl("a=1&b=2;c=3")
[('a', '1'), ('b', '2;c=3')]
>>> exit()

Since python is everywhere and the system functions as normal this should be enough to pass the update.

Whiteboard: MGA7TOO MGA8-64-OK => MGA7TOO MGA7-64-OK MGA8-64-OK

Comment 15 Thomas Andrews 2021-03-31 21:00:14 CEST
(In reply to Herman Viaene from comment #9)
> Using QARepo with the list of Comment 7, I seem to miss the
> python-2.7.18-1.3.mga7 and lib64python-devel-2.7.18-1.3.mga7 packages.

64-bit Plasma mga7 and mga8 systems, on AMD hardware.

Using a combination of the lists in Comment 3 and Comment 7, making sure to use only mga7 packages in mga7 and mga8 in mga8, I did not see the problem you saw, Herman.

Using the test delineated in the last sentence of Comment 14, this hardware tests out OK on both releases, too.

CC: (none) => andrewsfarm

Comment 16 Thomas Andrews 2021-03-31 21:44:39 CEST
As long as Foolishness (Dell Inspiron 5100, P4, Radeon RV200 graphics, Atheros-based wifi, 32-bit Xfce4 systems) had a full head of steam going in order to test other updates, I thought I'd check this one out, too.

Tested on both mga7 and mga8, using qarepo and the package lists of Comment 3 and Comment 7. No installation issues. Did a reboot each time, just because it seemed like the best thing to do. Using the test from Comment 15, it looks OK for 32-bit.

I'm going to go ahead and validate this one. Advisory in Comment 8.

CC: (none) => sysadmin-bugs
Whiteboard: MGA7TOO MGA7-64-OK MGA8-64-OK => MGA7TOO MGA7-64-OK MGA8-64-OK MGA7-32-OK MGA8-32-OK
Keywords: (none) => validated_update

Thomas Backlund 2021-04-02 10:47:00 CEST

Keywords: (none) => advisory

Comment 17 Mageia Robot 2021-04-02 12:17:54 CEST
An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2021-0165.html

Resolution: (none) => FIXED
Status: NEW => RESOLVED


Note You need to log in before you can comment on or make changes to this bug.