[SECURITY] [DLA 2938-1] twisted security update

Debian LTS Advisory DLA-2938-1 [email protected]
https://www.debian.org/lts/security/ Chris Lamb
March 08, 2022 https://wiki.debian.org/LTS

Package : twisted
Version : 16.6.0-2+deb9u2
CVE ID : CVE-2022-21716

It was discovered that there was an issue in the Twisted Python
network framework where SSH client and server implementions could
accept an infinite amount of data for the peer's SSH version
identifier and that a buffer then uses all available memory.

For Debian 9 "Stretch", this problem has been fixed in version
16.6.0-2+deb9u2.

We recommend that you upgrade your twisted packages.

For the detailed security status of twisted please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/twisted

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS