Most recent entries from all

ALSA-2023:2161 — Moderate: fence-agents security and bug fix update

Affected: AlmaLinux:9: fence-agents-aliyun, AlmaLinux:9: fence-agents-all, AlmaLinux:9: fence-agents-amt-ws, AlmaLinux:9: fence-agents-apc, AlmaLinux:9: fence-agents-apc-snmp, AlmaLinux:9: fence-agents-aws, AlmaLinux:9: fence-agents-azure-arm, AlmaLinux:9: fence-agents-bladecenter, AlmaLinux:9: fence-agents-brocade, AlmaLinux:9: fence-agents-cisco-mds and 45 more

The fence-agents packages provide a collection of scripts for handling remote power management for cluster devices. They allow failed or unreachable nodes to be forcibly restarted and removed from the cluster.

Security Fix(es):

* python-oauthlib: DoS when attacker provides malicious IPV6 URI (CVE-2022-36087)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Additional Changes:

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section.

bdu:2025-09877

BREW-ansible-CVE-2022-36087 — OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI

Affected: Homebrew: ansible

### Impact - Attacker providing malicious redirect uri can cause DoS to oauthlib's web application. - Attacker can also leverage usage of `uri_validate` functions depending where it is used.

_What kind of vulnerability is it? Who is impacted?_

Oauthlib applications using OAuth2.0 provider support or use directly `uri_validate` function.

### Patches _Has the problem been patched? What versions should users upgrade to?_

Issue fixed in 3.2.2 release.

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

The `redirect_uri` can be verified in web toolkit (i.e `bottle-oauthlib`, `django-oauth-toolkit`, ...) before oauthlib is called. A sample check if `:` is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required.

### References Attack Vector: - Attacker providing malicious redirect uri: https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232 - Vulnerable `uri_validate` functions: https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py

### PoC ```python is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path") ```

### Acknowledgement Special thanks to Sebastian Chnelik - PyUp.io

certfr-2025-avi-0969 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0969

EUVD-2026-232621

fkie_cve-2022-36087

OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.

GHSA-3pgj-pg6c-r5p7 — OAuthLib vulnerable to DoS when attacker provides malicious IPV6 URI

Affected: PyPI: oauthlib

### Impact - Attacker providing malicious redirect uri can cause DoS to oauthlib's web application. - Attacker can also leverage usage of `uri_validate` functions depending where it is used.

_What kind of vulnerability is it? Who is impacted?_

Oauthlib applications using OAuth2.0 provider support or use directly `uri_validate` function.

### Patches _Has the problem been patched? What versions should users upgrade to?_

Issue fixed in 3.2.2 release.

### Workarounds _Is there a way for users to fix or remediate the vulnerability without upgrading?_

### PoC ```python is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path") ```

### Acknowledgement Special thanks to Sebastian Chnelik - PyUp.io

gsd-2022-36087

OESA-2022-1971 — python-oauthlib security update

Affected: openEuler:22.03-LTS: python-oauthlib

Security Fix(es): OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.(CVE-2022-36087)

openSUSE-SU-2024:12339-1 — python310-oauthlib-3.2.1-1.1 on GA media

python310-oauthlib-3.2.1-1.1 on GA media

PYSEC-2022-269

Affected: PyPI: oauthlib

UBUNTU-CVE-2022-36087

Affected: Ubuntu:22.04:LTS: python-oauthlib

WID-SEC-W-2022-2378 — IBM Spectrum Protect: Schwachstelle ermöglicht Denial of Service

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in IBM Spectrum Protect ausnutzen, um einen Denial of Service Angriff durchzuführen.