[SECURITY] [DLA 2927-1] twisted security update

Debian LTS Advisory DLA-2927-1 [email protected]
https://www.debian.org/lts/security/ Sylvain Beucler
February 19, 2022 https://wiki.debian.org/LTS

Package : twisted
Version : 16.6.0-2+deb9u1
CVE ID : CVE-2020-10108 CVE-2020-10109 CVE-2022-21712
Debian Bug : 953950

It was discovered that Twisted, a Python event-based framework for
internet applications, is affected by HTTP request splitting
vulnerabilities, and may expose sensitive data when following
redirects. An attacker may bypass validation checks and retrieve
credentials.

CVE-2020-10108

HTTP request splitting vulnerability. When presented with two
content-length headers, it ignored the first header. When the
second content-length value was set to zero, the request body was
interpreted as a pipelined request.

CVE-2020-10109

HTTP request splitting vulnerability. When presented with a
content-length and a chunked encoding header, the content-length
took precedence and the remainder of the request body was
interpreted as a pipelined request.

CVE-2022-21712

Twisted exposes cookies and authorization headers when following
cross-origin redirects. This issue is present in the
`twisted.web.RedirectAgent` and
`twisted.web.BrowserLikeRedirectAgent` functions.

For Debian 9 stretch, these problems have been fixed in version
16.6.0-2+deb9u1.

We recommend that you upgrade your twisted packages.

For the detailed security status of twisted please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/twisted

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS