CVE:CVE-2021-23336
CNNVD:CNNVD-202102-1124
cpython是Python基金会的用C语言实现的Python解释器。
cpython 存在环境问题漏洞，攻击者可利用该漏洞可以使用分号(;)分隔查询参数，导致恶意请求被缓存为完全安全的请求。以下产品及版本受到影响：before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2。
solution:Upgrade python python to a higher version than 3.6.13,3.7.10,3.8.8,3.9.2,and avoid the version (,3.6.13),[3.7.0,3.7.10),[3.8.0,3.8.8),[3.9.0,3.9.2); Upgrade fedoraproject fedora to a higher version than 32,33,34,and avoid the version 32,33,34; Upgrade debian debian_linux to a higher version than 9.0,and avoid the version 9.0; Upgrade netapp cloud_backup to a higher version than -; Upgrade netapp inventory_collect_tool to a higher version than -; Upgrade netapp ontap_select_deploy_administration_utility to a higher version than -; Upgrade netapp snapcenter to a higher version than -; Upgrade djangoproject django to a higher version than 2.2.19,3.0.13,3.1.7,and avoid the version [2.2,2.2.19),[3.0,3.0.13),[3.1,3.1.7); Upgrade oracle communications_offline_mediation_controller to a higher version than 12.0.0.3.0,and avoid the version 12.0.0.3.0; Upgrade oracle communications_pricing_design_center to a higher version than 12.0.0.3.0,and avoid the version 12.0.0.3.0; Upgrade oracle enterprise_manager_ops_center to a higher version than 12.4.0.0,and avoid the version 12.4.0.0; Upgrade oracle zfs_storage_appliance to a higher version than 8.8,and avoid the version 8.8