PT-2022-23176 · Oauthlib +5 · Oauthlib +5

Name of the Vulnerable Software and Affected Versions: OAuthLib versions 3.1.1 through 3.2.1 Description: The issue allows an attacker providing a malicious redirect uri to cause denial of service. An attacker can also leverage the usage of uri validate functions depending on where it is used...

OAuthLib has a vulnerability related to input validation.

OAuthLib is OAuthLib open source a Python framework for OAuth1 and OAuth2. An input validation error vulnerability exists in OAuthLib versions 3.1.1 through 3.2.1. An attacker exploiting this vulnerability to provide a malicious redirect uri can cause a denial of service...

annalist (0.5.18), anoteai (>=0.10.0, <=0.20.0) +113 more potentially affected by CVE-2022-36087 via oauthlib (>=3.1.1, <=3.2.1)

oauthlib PYPI version =3.1.1, =0.10.0, =4.0.1, =0.2.1, =0.7.11, =0.2.11, =1.0.0, =1.1.71, =1.2.0, =0.3.7, =1.0.28, =0.3.0, =0.0.33, =0.1.0, =0.3.9 and more Source cves: CVE-2022-36087 Source advisory: MEND:CVE-2022-36087...

CVE-2022-36087: Improper Input Validation

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of urivalidate functions depending where it is used. OAuthLib...

CVE-2022-36087 OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of urivalidate functions depending where it is used. OAuthLib...

CVE-2022-36087 OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of urivalidate functions depending where it is used. OAuthLib...

CVE-2022-36087

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of urivalidate functions depending where it is used. OAuthLib...

CVE-2022-36087 OAuthLib vulnerable DoS when attacker provides malicious IPV6 URI

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of urivalidate functions depending where it is used. OAuthLib...

new packages: python-requests-oauthlib

An update is available for python-requests-oauthlib. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the...

new packages: python-oauthlib

An update is available for python-oauthlib. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Cross site request forgery (csrf)

Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login via OAuth incorrectly uses the state parameter to pass the next URL to redirect the user to after login. The state parameter should be used for a Cross-Site Request Forgery...

CVE-2021-43777

Redash 10.0 and earlier are affected by CVE-2021-43777 due to improper use of the OAuth state parameter in Google Login, where the state is used to pass the next URL instead of a CSRF nonce. The issue does not affect non-Google-Login users. A patch in the master and release/10.x.x branches replac...

CVE-2021-43777: Cross-Site Request Forgery (CSRF)

Redash is a package for data visualization and sharing. In Redash version 10.0 and prior, the implementation of Google Login via OAuth incorrectly uses the state parameter to pass the next URL to redirect the user to after login. The state parameter should be used for a Cross-Site Request Forgery...