Update dependency oauthlib to ~=3.2.2 [SECURITY] - autoclosed

[renovate]

This PR contains the following updates:

Package	Change	Age	Adoption	Passing	Confidence
oauthlib	~=3.1.0 -> ~=3.2.2

GitHub Vulnerability Alerts

CVE-2022-36087

Impact

• Attacker providing malicious redirect uri can cause DoS to oauthlib's web application.
• Attacker can also leverage usage of uri_validate functions depending where it is used.

What kind of vulnerability is it? Who is impacted?

Oauthlib applications using OAuth2.0 provider support or use directly uri_validate function.

Patches

Has the problem been patched? What versions should users upgrade to?

Issue fixed in 3.2.2 release.

Workarounds

Is there a way for users to fix or remediate the vulnerability without upgrading?

The redirect_uri can be verified in web toolkit (i.e bottle-oauthlib, django-oauth-toolkit, ...) before oauthlib is called. A sample check if : is present to reject the request can prevent the DoS, assuming no port or IPv6 is fundamentally required.

References

Attack Vector:

• Attacker providing malicious redirect uri:
  https://github.com/oauthlib/oauthlib/blob/d4bafd9f1d0eba3766e933b1ac598cbbf37b8914/oauthlib/oauth2/rfc6749/grant_types/base.py#L232
• Vulnerable uri_validate functions:
  https://github.com/oauthlib/oauthlib/blob/2b8a44855a51ad5a5b0c348a08c2564a2e197ea2/oauthlib/uri_validate.py

PoC

is_absolute_uri("http://[:::::::::::::::::::::::::::::::::::::::]/path")

Acknowledgement

Special thanks to Sebastian Chnelik - PyUp.io

---

Release Notes

oauthlib/oauthlib (oauthlib)

v3.2.2

Compare Source

OAuth2.0 Provider:

• CVE-2022-36087

v3.2.1

Compare Source

OAuth2.0 Provider:

• #​803: Metadata endpoint support of non-HTTPS

OAuth1.0:

• #​818: Allow IPv6 being parsed by signature

General:

• Improved and fixed documentation warnings.
• Cosmetic changes based on isort

v3.2.0

Compare Source

OAuth2.0 Client:

• #​795: Add Device Authorization Flow for Web Application
• #​786: Add PKCE support for Client
• #​783: Fallback to none in case of wrong expires_at format.

OAuth2.0 Provider:

• #​790: Add support for CORS to metadata endpoint.
• #​791: Add support for CORS to token endpoint.
• #​787: Remove comma after Bearer in WWW-Authenticate

OAuth2.0 Provider - OIDC:

• #​755: Call save_token in Hybrid code flow
• #​751: OIDC add support of refreshing ID Tokens with refresh_id_token
• #​751: The RefreshTokenGrant modifiers now take the same arguments as the
  AuthorizationCodeGrant modifiers (token, token_handler, request).

General:

• Added Python 3.9, 3.10, 3.11
• Improve Travis & Coverage

---

Configuration

📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

---

• If you want to rebase/retry this PR, check this box

---

This PR has been generated by Mend Renovate. View repository job log here.