Lucene search

K
debianDebianDEBIAN:DLA-2927-1:FE743
HistoryFeb 19, 2022 - 4:30 p.m.

[SECURITY] [DLA 2927-1] twisted security update

2022-02-1916:30:59
lists.debian.org
6

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

69.0%


Debian LTS Advisory DLA-2927-1 [email protected]
https://www.debian.org/lts/security/ Sylvain Beucler
February 19, 2022 https://wiki.debian.org/LTS


Package : twisted
Version : 16.6.0-2+deb9u1
CVE ID : CVE-2020-10108 CVE-2020-10109 CVE-2022-21712
Debian Bug : 953950

It was discovered that Twisted, a Python event-based framework for
internet applications, is affected by HTTP request splitting
vulnerabilities, and may expose sensitive data when following
redirects. An attacker may bypass validation checks and retrieve
credentials.

CVE-2020-10108

HTTP request splitting vulnerability. When presented with two
content-length headers, it ignored the first header. When the
second content-length value was set to zero, the request body was
interpreted as a pipelined request.

CVE-2020-10109

HTTP request splitting vulnerability. When presented with a
content-length and a chunked encoding header, the content-length
took precedence and the remainder of the request body was
interpreted as a pipelined request.

CVE-2022-21712

Twisted exposes cookies and authorization headers when following
cross-origin redirects. This issue is present in the
`twisted.web.RedirectAgent` and
`twisted.web.BrowserLikeRedirectAgent` functions.

For Debian 9 stretch, these problems have been fixed in version
16.6.0-2+deb9u1.

We recommend that you upgrade your twisted packages.

For the detailed security status of twisted please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/twisted

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

69.0%

Related for DEBIAN:DLA-2927-1:FE743