OPENSUSE-SU-2024:14236-1 python-Twisted-doc-24.3.0-2.1 on GA media

These are all security issues fixed in the python-Twisted-doc-24.3.0-2.1 package on the GA media of openSUSE Tumbleweed...

CVE-2024-41810

A Cross-site scripting XSS vulnerability exists in Python-Twisted in the twisted.web.util.redirectTo function. This flaw allows an attacker to control the redirect URL, leading to reflected XSS in the HTML body of the redirect response. If exploited, a remote attacker could inject malicious HTML,...

HTML Injection

twisted is vulnerable to an HTML injection. The vulnerability is due to improper sanitization of the redirect URL which attackers can exploit to inject malicious scripts into the web page. potentially leads to Reflected Cross-Site Scripting XSS in the redirect response HTML body...

HTTP Request/Response Smuggling

Twisted is vulnerable to HTTP Request/Response Smuggling. The vulnerability is due to the HTTP 1.0 and 1.1 server provided by twisted.web which can process pipelined HTTP requests out-of-order...

adyanutils (>=0.4.0 <=0.8.6), apricot-server (>=0.0.1 <=0.1.1) +127 more potentially affected by CVE-2024-41810 via twisted (>=20.3.0 <=24.7.0)

twisted PYPI version =20.3.0, =0.4.0, =0.0.1, =0.2.0, =3.4.1, =1.5.0, =1.5.0, =0.2.0, =0.0.2, =1.9.0, =0.2.86, =202406.1129.0, =3.9.2, =1.0.0, =1.1.0 and more Source cves: CVE-2024-41810 Source advisory: OSV:GHSA-CF56-G6W6-PQQ2...

GHSA-CF56-G6W6-PQQ2 Twisted vulnerable to HTML injection in HTTP redirect body

Summary The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting XSS in the redirect response HTML body. Details Twisted’s redirectTo functi...

Twisted vulnerable to HTML injection in HTTP redirect body

Summary The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting XSS in the redirect response HTML body. Details Twisted’s redirectTo functi...

adyanutils (>=0.4.0 <=0.8.6), apricot-server (>=0.0.1 <=0.1.1) +127 more potentially affected by CVE-2024-4167 +1 more via twisted (>=20.3.0 <=24.7.0)

twisted PYPI version =20.3.0, =0.4.0, =0.0.1, =0.2.0, =3.4.1, =1.5.0, =1.5.0, =0.2.0, =0.0.2, =1.9.0, =0.2.86, =202406.1129.0, =3.9.2, =1.0.0, =1.1.0 and more Source cves: CVE-2024-4167, CVE-2024-41671 Source advisory: OSV:GHSA-C8M8-J448-XJX7...

twisted.web has disordered HTTP pipeline response

Summary The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. PoC 0. Start a fresh Debian container: sh docker run --workdir /repro --rm -it debian:bookworm-slim 1. Install twisted and its dependencies...

AZL-47195 CVE-2024-41810 affecting package python-twisted for versions less than 22.10.0-3

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site...

DEBIAN-CVE-2024-41810

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site...

CVE-2024-41810

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site...

AZL-47073 CVE-2024-41810 affecting package python-twisted for versions less than 22.10.0-3

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site...

adyanutils (>=0.4.0 <=0.8.6), apricot-server (>=0.0.1 <=0.1.1) +127 more potentially affected by CVE-2024-41810 via twisted (>=20.3.0 <=24.7.0)

twisted PYPI version =20.3.0, =0.4.0, =0.0.1, =0.2.0, =3.4.1, =1.5.0, =1.5.0, =0.2.0, =0.0.2, =1.9.0, =0.2.86, =202406.1129.0, =3.9.2, =1.0.0, =1.1.0 and more Source cves: CVE-2024-41810 Source advisory: OSV:PYSEC-2024-75...

UBUNTU-CVE-2024-41810

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site...

PYSEC-2024-75

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site...

PYSEC-2024-75

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site...

CVE-2024-41810 HTML injection in HTTP redirect body

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site...

CVE-2024-41810 HTML injection in HTTP redirect body

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site...

CVE-2024-41810 HTML injection in HTTP redirect body

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The twisted.web.util.redirectTo function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site...