CVE-2021-23336 · cross-distro fix matrix

CVE-2021-23336: The package python/cpython from 0 and before 3.6.13, from 3.7.0 and before 3.7.10, from 3.8.0 and before 3.8.8, from 3.9.0 and before 3.9.2 are vulnerable to Web Cache Poisoning via urllib.parse.parse_qsl and urllib.parse.parse_qs by using a vector called parameter cloaking. When the attacker can se

Affects 8 Linux releases across 18 (distro × package) combinations.

Fix per ecosystem

Each block below is a distro release where CVE-2021-23336 has a known fix. Run the listed command on that distro to remediate.

Source: Debian Security Tracker

pypy3→ fixed in7.3.3+dfsg-3urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y pypy3
```
python-django→ fixed in2:2.2.19-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y python-django
```
python2.7→ fixed in2.7.18-8+deb11u1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y python2.7
```
python3.9→ fixed in3.9.2-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y python3.9
```

Source: Debian Security Tracker

pypy3→ fixed in7.3.3+dfsg-3urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y pypy3
```
python-django→ fixed in2:2.2.19-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y python-django
```

Source: Debian Security Tracker

pypy3→ fixed in7.3.3+dfsg-3urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y pypy3
```
python-django→ fixed in2:2.2.19-1urgency: not yet assigned
```
sudo apt-get install --only-upgrade -y python-django
```