{"containers": {"cna": {"providerMetadata": {"dateUpdated": "2021-02-15T16:01:12", "orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "shortName": "snyk"}, "rejectedReasons": [{"lang": "en", "value": "DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-23336. Reason: This candidate is a reservation duplicate of CVE-2021-23336. Notes: All CVE users should reference CVE-2021-23336 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage"}]}}, "cveMetadata": {"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730", "assignerShortName": "snyk", "cveId": "CVE-2020-28476", "datePublished": "2021-01-18T11:15:20", "dateRejected": "2021-02-15T16:01:12", "dateReserved": "2020-11-12T00:00:00", "dateUpdated": "2021-02-15T16:01:12", "state": "REJECTED"}, "dataType": "CVE_RECORD", "dataVersion": "5.0"}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2021-23336. Reason: This candidate is a reservation duplicate of CVE-2021-23336. Notes: All CVE users should reference CVE-2021-23336 instead of this candidate. All references and descriptions in this candidate have been removed to prevent accidental usage"}], "id": "CVE-2020-28476", "lastModified": "2023-11-07T03:21:22.360", "metrics": {}, "published": "2021-01-18T12:15:13.113", "references": [], "sourceIdentifier": "report@snyk.io", "vulnStatus": "Rejected"}

{"bugzilla": {"description": "python-tornado: Web Cache Poisoning by using a vector called parameter cloaking may lead to Integrity and Availability compromise", "id": "1926768", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1926768"}, "csaw": false, "cvss3": {"cvss3_base_score": "6.8", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:H", "status": "draft"}, "cwe": "CWE-444", "details": ["A flaw was found in python-tornado. All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configuration) and the server. This issue results in malicious requests cached as completely safe ones. The highest threat from this vulnerability is to integrity and system availability."], "name": "CVE-2020-28476", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "python-tornado", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "python-tornado", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2021-01-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2020-28476\nhttps://nvd.nist.gov/vuln/detail/CVE-2020-28476\nhttps://snyk.io/vuln/SNYK-PYTHON-TORNADO-1017109"], "threat_severity": "Moderate"}