Bug 1926768 (CVE-2020-28476)

Summary:	CVE-2020-28476 python-tornado: Web Cache Poisoning by using a vector called parameter cloaking may lead to Integrity and Availability compromise
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED NOTABUG	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	aurelien, dbecker, gwync, jjoyce, jschluet, lhh, lpeer, mail, mburns, mhroncok, orion, python-maint, python-sig, rhel8-maint, sclewis, slinaber, tomspur
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in python-tornado. All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This issue results in malicious requests cached as completely safe ones. The highest threat from this vulnerability is to integrity and system availability.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-02-16 13:59:40 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	1926769, 1926770, 1928196
Bug Blocks:	1926772

Description Marian Rehak 2021-02-09 12:31:48 UTC

All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This can result in malicious requests being cached as completely safe ones.

Reference:

https://snyk.io/vuln/SNYK-PYTHON-TORNADO-1017109

Comment 1 Marian Rehak 2021-02-09 12:32:29 UTC

Created python-tornado tracking bugs for this issue:

Affects: epel-8 [bug 1926770]
Affects: fedora-all [bug 1926769]

Comment 2 Riccardo Schirone 2021-02-12 15:56:32 UTC

Created python3-tornado tracking bugs for this issue:

Affects: epel-all [bug 1928196]

Comment 3 Riccardo Schirone 2021-02-12 16:05:38 UTC

External References:

https://snyk.io/vuln/SNYK-PYTHON-TORNADO-1017109

Comment 4 Riccardo Schirone 2021-02-16 13:59:40 UTC

This CVE was rejected by upstream. See at CVE-2021-23336.