Skip to content
Fencer Vulns
medium 5.9

CVE-2021-23336 json

Web Cache Poisoning

published 2021-02-15 5 y ago modified 2026-10-14 25 d ago also BIT-django-2021-23336 , BIT-libpython-2021-23336 , BIT-python-2021-23336 , BIT-python-min-2021-23336 , EUVD-2021-10423

cvss
5.9
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
40.7%
EPSS 40.7% chance of exploitation in 30 days, percentile 98%
public exploits
0
none known

Summary

The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones, as the proxy would usually not see the semicolon as a separator, and therefore would not include it in a cache key of an unkeyed parameter.

Patch / fix

  • bitnami django 2.2.19, 3.0.13, 3.1.7
  • bitnami libpython 3.6.13, 3.7.10, 3.8.8, 3.9.2
  • bitnami python 3.6.13, 3.7.10, 3.8.8, 3.9.2
  • bitnami python-min 3.6.13, 3.7.10, 3.8.8, 3.9.2
  • n/a python/cpython 3.6.13, 3.7.10, 3.8.8, 3.9.2
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP V3.1.5
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP V3.1.5
  • pypy3 Debian 14, Debian 13, Debian 12 7.3.3+dfsg-3
  • python-django Debian 14, Debian 13, Debian 12 2:2.2.19-1

debian advisories DEBIAN-CVE-2021-23336

  • python3.9 Ubuntu 20.04 LTS 3.9.5-3~20.04.1
  • python-django Ubuntu 18.04 LTS 1:1.11.11-1ubuntu1.11
  • python-django Ubuntu 20.04 LTS 2:2.2.12-1ubuntu0.4

ubuntu advisories UBUNTU-CVE-2021-23336

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • pytz RHEL 8 2019.3-3.module+el8.4.0+8888+89bc7e79
  • babel RHEL 8 2.7.0-11.module+el8.5.0+11015+9c1c7c42
  • numpy RHEL 8 1.17.3-6.module+el8.5.0+12205+a865257a
  • scipy RHEL 8 1.3.1-4.module+el8.4.0+8888+89bc7e79
  • Cython RHEL 8 0.29.14-4.module+el8.4.0+8888+89bc7e79
  • pytest RHEL 8 4.6.6-3.module+el8.4.0+8888+89bc7e79
  • PyYAML RHEL 8 5.4.1-1.module+el8.5.0+10721+14d8e0d5
  • mod_wsgi RHEL 8 4.6.8-3.module+el8.4.0+8888+89bc7e79

red hat advisories RHSA-2021:4162RHSA-2021:4151RHSA-2021:3252RHSA-2021:3254RHSA-2021:1633

  • kibana OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 4.6.6-3.9.2
  • grafana OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 6.7.4-4.18.2
  • cassandra OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 3.11.10-5.3.5
  • python-py OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.4.34-3.3.3
  • crowbar-core OpenStack Cloud Crowbar 8 5.0+git.1622489449.a8e60e238-3.50.4
  • python-Django OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 1.11.29-3.25.3
  • ardana-cobbler OpenStack Cloud 8, HPE Helion OpenStack 8 8.0+git.1614096566.e8c2b27-3.44.3
  • openstack-nova OpenStack Cloud Crowbar 8, OpenStack Cloud 8, HPE Helion OpenStack 8 16.1.9~dev92-3.48.5

suse advisories SUSE-SU-2021:2554-1SUSE-SU-2021:1962-1SUSE-SU-2021:0947-1SUSE-SU-2021:0887-1SUSE-SU-2021:0886-1SUSE-SU-2021:0794-1

  • python-w3lib openSUSE Tumbleweed 2.5.0-1.1
  • python-yarl openSUSE Tumbleweed 1.24.5-1.1
  • python315 openSUSE Tumbleweed 3.15.0~a1-1.1
  • python314 openSUSE Tumbleweed 3.14.0~a1-1.1
  • python313 openSUSE Tumbleweed 3.13.0~b3-1.1
  • python openSUSE Tumbleweed 2.7.18-8.1
  • python-w3lib openSUSE Tumbleweed 1.22.0-2.4
  • python310 openSUSE Tumbleweed 3.10.0rc1-4.2

opensuse advisories openSUSE-SU-2026:11948-1openSUSE-SU-2026:11589-1openSUSE-SU-2025:15713-1openSUSE-SU-2024:14434-1openSUSE-SU-2024:14109-1openSUSE-SU-2024:11202-1

  • python38-py AlmaLinux 8 1.8.0-8.module_el8.6.0+2778+cd494b30
  • python38-ply AlmaLinux 8 3.11-10.module_el8.6.0+2778+cd494b30
  • python38-six AlmaLinux 8 1.12.0-10.module_el8.6.0+2778+cd494b30
  • python38-cffi AlmaLinux 8 1.13.2-3.module_el8.6.0+2778+cd494b30
  • python38-idna AlmaLinux 8 2.8-6.module_el8.6.0+2778+cd494b30
  • python38-pytz AlmaLinux 8 2019.3-3.module_el8.6.0+2778+cd494b30
  • python38-attrs AlmaLinux 8 19.3.0-3.module_el8.6.0+2778+cd494b30
  • python38-babel AlmaLinux 8 2.7.0-11.module_el8.6.0+2778+cd494b30

almalinux advisories ALSA-2021:4162ALSA-2021:4151

  • pytz Rocky Linux 8 2019.3-3.module+el8.4.0+570+c2eaf144
  • babel Rocky Linux 8 2.7.0-11.module+el8.5.0+672+ab6eb015
  • numpy Rocky Linux 8 1.17.3-6.module+el8.5.0+672+ab6eb015
  • scipy Rocky Linux 8 1.3.1-4.module+el8.5.0+672+ab6eb015
  • scipy Rocky Linux 8 1.3.1-4.module+el8.4.0+570+c2eaf144
  • Cython Rocky Linux 8 0.29.14-4.module+el8.4.0+570+c2eaf144
  • pytest Rocky Linux 8 4.6.6-3.module+el8.4.0+570+c2eaf144
  • PyYAML Rocky Linux 8 5.4.1-1.module+el8.5.0+672+ab6eb015

rocky linux advisories RLSA-2021:4162RLSA-2021:4151

  • python3 Alpine 3.24, Alpine 3.23, Alpine 3.22 +10 more 3.8.8-r0
  • py3-django Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 3.1.7-r0

alpine advisories ALPINE-CVE-2021-23336

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • python2 CBL-Mariner 2.0 2.7.18-8

azure linux advisories AZL-6827

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

  • python Arch Linux 3.9.2-1
  • python-django Arch Linux 3.1.7-1

arch linux advisories AVG-1465AVG-1593

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2021-23336 updated cvss 5.9

python: Web cache poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a semicolon in query parameters

  • Red Hat Ceph Storage 2 python-django, python-django-bash-completion
    affected: no fix planned “Out of support scope”
  • Red Hat Ceph Storage 3 python-django, python-django-bash-completion
    affected: no fix available “Fix deferred”
  • Red Hat Enterprise Linux 6 python, tkinter, python-libs, python-test, python-tools Red Hat Enterprise Linux 7 python, python3, tkinter, python-libs, python-test, python-tools, +4 more Red Hat OpenStack Platform 10 (Newton) python-django, python-django-bash-completion
    affected: no fix planned “Out of support scope”
  • Red Hat OpenStack Platform 13 (Queens) python-django, python2-django, python-django-bash-completion Red Hat OpenStack Platform 16.1 python-django, python-django20, python3-django20, python-django20-bash-completion Red Hat Storage 3 python-django, python2-django, python-django-bash-completion Red Hat Update Infrastructure 3 for Cloud Providers python-django
    affected: no fix planned “Will not fix”
  • Red Hat CodeReady Linux Builder (v. 8) pytest 4.6.6-3.module+el8.4.0+8888+89bc7e79, python-py 1.8.0-8.module+el8.4.0+8888+89bc7e79, python38-py 1.8.0-8.module+el8.4.0+8888+89bc7e79, python-attrs 19.3.0-3.module+el8.4.0+8888+89bc7e79, python-pluggy 0.13.0-3.module+el8.4.0+8888+89bc7e79, python-packaging 19.2-3.module+el8.4.0+8888+89bc7e79, +12 more
    fixed: vendor fix RHSA-2021:4162
  • Red Hat Enterprise Linux AppStream (v. 8) python3-idle 3.6.8-37.el8, python3-test 3.6.8-37.el8, platform-python 3.6.8-37.el8, python3-tkinter 3.6.8-37.el8, pytz 2019.3-3.module+el8.4.0+8888+89bc7e79, scipy 1.3.1-4.module+el8.4.0+8888+89bc7e79, +152 more Red Hat Enterprise Linux BaseOS (v. 8) python3 3.6.8-37.el8, python3-libs 3.6.8-37.el8, python3-test 3.6.8-37.el8, platform-python 3.6.8-37.el8
    fixed: vendor fix RHSA-2021:1633
  • Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) python27-babel 0.9.6-10.el7, python27-python 2.7.18-3.el7, python27-tkinter 2.7.18-3.el7, rh-python38-babel 2.7.0-12.el7, rh-python38-python 3.8.11-2.el7, python27-python-jinja2 2.6-16.el7, +18 more Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.7) python27-babel 0.9.6-10.el7, python27-python 2.7.18-3.el7, python27-tkinter 2.7.18-3.el7, rh-python38-babel 2.7.0-12.el7, rh-python38-python 3.8.11-2.el7, python27-python-jinja2 2.6-16.el7, +18 more Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) python27-babel 0.9.6-10.el7, python27-python 2.7.18-3.el7, python27-tkinter 2.7.18-3.el7, rh-python38-babel 2.7.0-12.el7, rh-python38-python 3.8.11-2.el7, python27-python-jinja2 2.6-16.el7, +18 more
    fixed: vendor fix RHSA-2021:3252
  • Red Hat Enterprise Linux 8 numpy, scipy, PyYAML, mod_wsgi, python36, python39, +71 more Red Hat Enterprise Linux 9 python3, python2.7, python3.9, python3-idle, python3-libs, python3-test, +2 more Red Hat Satellite 6 python-django, python2-django, python-django-bash-completion
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-23-348-10 updated cvss 5.9

Siemens SIMATIC S7-1500

  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP (6ES7518-4AX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AB0) >= 3.1.0, < 3.1.5 Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP (6ES7518-4FX00-1AC0) >= 3.1.0, < 3.1.5 Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP (6AG1518-4AX00-4AC0) >= 3.1.0, < 3.1.5
    affected: fixed in V3.1.5, mitigation support.industry.siemens.com

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
partial
Assessed
10 mo ago

Exploit prediction

40.74% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • snyk.io https://snyk.io/vuln/SNYK-UPSTREAM-PYTHONCPYTHON-1074933 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H/E:P/RL:U/RC:C
CNA 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
NVD 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H
NVD 2.0 4.0 AV:N/AC:H/Au:N/C:N/I:P/A:P
OSV 3.1 5.9 CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:H

Affected packages

ecosystem package affected fixed in
bitnami django
>=2.2.0, <2.2.19
>=3.0.0, <3.0.13
>=3.1.0, <3.1.7
2.2.19
3.0.13
3.1.7
bitnami libpython
<3.6.13
>=3.7.0, <3.7.10
>=3.8.0, <3.8.8
>=3.9.0, <3.9.2
3.6.13
3.7.10
3.8.8
3.9.2
bitnami python
<3.6.13
>=3.7.0, <3.7.10
>=3.8.0, <3.8.8
>=3.9.0, <3.9.2
3.6.13
3.7.10
3.8.8
3.9.2
bitnami python-min
<3.6.13
>=3.7.0, <3.7.10
>=3.8.0, <3.8.8
>=3.9.0, <3.9.2
3.6.13
3.7.10
3.8.8
3.9.2

Affected products

  • n/a python/cpython
  • Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
  • Siemens SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP
  • Siemens SIPLUS S7-1500 CPU 1518-4 PN/DP MFP

Classification

Weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.