Debian: Security Advisory (DLA-2938-1)

The remote host is missing an update for the Debian SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] [DLA 2938-1] twisted security update

------------------------------------------------------------------------- Debian LTS Advisory DLA-2938-1 [email protected] https://www.debian.org/lts/security/ Chris Lamb March 08, 2022 https://wiki.debian.org/LTS -...

Debian DLA-2938-1 : twisted - LTS security update

The remote Debian 9 host has packages installed that are affected by a vulnerability as referenced in the dla-2938 advisory. - Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an...

DLA-2938-1 twisted - security update

Bulletin has no description...

SUSE: Security Advisory (SUSE-SU-2022:0734-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2022-21716

An uncontrolled resource consumption flaw was found in python-twisted in the dataReceived function. This flaw allows an unauthenticated, remote attacker to send a simple command to use all available memory and crash the server...

SUSE-SU-2022:0734-1 Security update for python-Twisted

This update for python-Twisted fixes the following issues: - CVE-2022-21712: Fixed secret exposure in cross-origin redirects bsc1195667, GHSA-92x2-jw7w-xvvx from...

Denial Of Service (DoS)

twisted is vulnerable to denial of service. The vulnerability exists due to the lack of validation of the peer's SSH version identifier and accepting an infinite amount of data allowing an attacker to craft a request that uses all available memory and crashes the server,...

Twisted has unspecified vulnerabilities

Twisted is an event-driven open source network engine written in Python. Twisted has security vulnerabilities, and no details of the vulnerabilities are currently available...

CVE-2022-21716

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach...

DEBIAN-CVE-2022-21716

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach...

Design/Logic Flaw

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach...

adyanutils (>=0.4.0 <=0.8.6), ayugespidertools (>=3.4.1 <=3.9.5) +52 more potentially affected by CVE-2022-21716 via twisted (>=21.7.0 <=22.1.0)

twisted PYPI version =21.7.0, =0.4.0, =3.4.1, =1.6.0, =0.2.0, =3.9.2, =21.0.0, =1.1.2.post3, =0.1.0, =0.4.0, =0.7.2, =1.0.0, =1.0.0, =0.8.0, =0.9.0 and more Source cves: CVE-2022-21716 Source advisory: OSV:PYSEC-2022-160...

PYSEC-2022-160

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach...

CVE-2022-21716

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach...

UBUNTU-CVE-2022-21716

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach...

PYSEC-2022-160

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach...

adyanutils (>=0.4.0 <=0.8.6), ayugespidertools (>=3.4.1 <=3.9.5) +52 more potentially affected by CVE-2022-21716 via twisted (>=21.7.0 <=22.1.0)

twisted PYPI version =21.7.0, =0.4.0, =3.4.1, =1.6.0, =0.2.0, =3.9.2, =21.0.0, =1.1.2.post3, =0.1.0, =0.4.0, =0.7.2, =1.0.0, =1.0.0, =0.8.0, =0.9.0 and more Source cves: CVE-2022-21716 Source advisory: OSV:GHSA-RV6R-3F5Q-9RGX...

Twisted SSH client and server deny of service during SSH handshake.

Impact The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier. A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as...

GHSA-RV6R-3F5Q-9RGX Twisted SSH client and server deny of service during SSH handshake.

Impact The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier. A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as...