CVE-2022-36087: fedoraproject fedora Improper Input Validation
Vulnerability summary
CVE-2022-36087 is a medium (CVSS 6.5) Improper Input Validation vulnerability in fedoraproject fedora. EPSS estimates a 1.67% chance of exploitation in the next 30 days, higher than 76.4% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 09-09-2022PublishedVulnerability first disclosed.
- 22-04-2025Last modifiedVulnerability information updated.
Description
OAuthLib is an implementation of the OAuth request-signing logic for Python 3.6+. In OAuthLib versions 3.1.1 until 3.2.1, an attacker providing malicious redirect uri can cause denial of service. An attacker can also leverage usage of `uri_validate` functions depending where it is used. OAuthLib applications using OAuth2.0 provider support or use directly `uri_validate` are affected by this issue. Version 3.2.1 contains a patch. There are no known workarounds.
CVSS metrics
7 scores · 6 sources · 2 versions- CVE.orgCNA5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · PypiEcosystem advisory · calculated5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · Red hatEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · UbuntuEcosystem advisory · calculated5.7MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:HDiffers
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.67%
Chance of exploitation in the next 30 days
Percentile
76%
Versus all other CVEs
30-day change
+0.01 pp
From 1.66% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundOauthlib
Maturity: poc
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-601URL Redirection to Untrusted Site ('Open Redirect')The web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a redirect.
Affected systems
Redhat68 products
- fence-agents< 0:4.10.0-43.el9
- fence-agents-aliyun< 0:4.10.0-43.el9
- fence-agents-all< 0:4.10.0-43.el9
- fence-agents-amt-ws< 0:4.10.0-43.el9
- fence-agents-apc< 0:4.10.0-43.el9
Debian1 product
- python-oauthlib< 3.2.1-1
Fedoraproject1 product
- fedoraEOL37
Oauthlib1 product
- oauthlib≥ 3.1.1, < 3.2.1
Oauthlib_project1 product
- oauthlib≥ 3.1.1, < 3.2.1
Opensuse1 product
- python-oauthlib&distro=openSUSE Tumbleweed< 3.2.2-5.4
PyPI1 product
- oauthlib≥ 3.1.1, < 3.2.2 | < 2e40b412c844ecc4673c3fa3f72181f228bdbacd | ≥ 3.1.1, < 3.2.1
Ubuntu1 product
- python-oauthlib< 3.2.0-1ubuntu0.1
8 vendors · 75 products
References
36 links- github.com/oauthlib/oauthlib/security/advisories/GHSA-3pgj-pg6c-r5p7WEBAdvisoryARTICLEREPORTExploitMitigationThird Party Advisory
- github.com/oauthlib/oauthlib/commit/2e40b412c844ecc4673c3fa3f72181f228bdbacdWEBFIXPatchThird Party Advisory
- github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.pyWEBExploitThird Party Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
- lists.fedoraproject.org/archives/…Vendor Advisory
Show all 36 references
- github.com/oauthlib/oauthlibPACKAGE
- lists.opensuse.org/archives/…Advisory