[SECURITY] [DLA 2927-1] twisted security update
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2927-1 debian-lts@lists.debian.org
https://www.debian.org/lts/security/ Sylvain Beucler
February 19, 2022 https://wiki.debian.org/LTS
- -------------------------------------------------------------------------
Package : twisted
Version : 16.6.0-2+deb9u1
CVE ID : CVE-2020-10108 CVE-2020-10109 CVE-2022-21712
Debian Bug : 953950
It was discovered that Twisted, a Python event-based framework for
internet applications, is affected by HTTP request splitting
vulnerabilities, and may expose sensitive data when following
redirects. An attacker may bypass validation checks and retrieve
credentials.
CVE-2020-10108
HTTP request splitting vulnerability. When presented with two
content-length headers, it ignored the first header. When the
second content-length value was set to zero, the request body was
interpreted as a pipelined request.
CVE-2020-10109
HTTP request splitting vulnerability. When presented with a
content-length and a chunked encoding header, the content-length
took precedence and the remainder of the request body was
interpreted as a pipelined request.
CVE-2022-21712
Twisted exposes cookies and authorization headers when following
cross-origin redirects. This issue is present in the
`twisted.web.RedirectAgent` and
`twisted.web.BrowserLikeRedirectAgent` functions.
For Debian 9 stretch, these problems have been fixed in version
16.6.0-2+deb9u1.
We recommend that you upgrade your twisted packages.
For the detailed security status of twisted please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/twisted
Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----
iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmIRF3oACgkQDTl9HeUl
XjCVPA//fL6aqybmO5RiIoiLmx/69dncWCB9TnVLJ/uhO3UN8DszHeWCG85cNnZL
DLxKLq2nqpQZ5q7AX5g1dIxsZyGvFSWHgbHEaPqgTmM9I61X93vmzLFK1cqVqFI2
LKiGbDVCTJh70IySLI42D/7uNDsZmAdIsB4PrcjDOk4MwDa20SjKC8c2qmxpKpBM
9DkJJ0OkIzN5OIAP2/iJDiXF+kv0iJeOaOdINcbXwAXhB7hk7MpznG91VKiBazSs
VcwK+3QURFLufNK2wf1r4jTLQa03BNrUN31S+H7V8whNnYOCPGVXcNqdQL/mHm7N
/EFiQ253k5F+FS6ZVROpTtlqH7NVhm3vWNBHmEc+nGSNmAWh/4INITl1kYlLMoKf
W3u43cE7+fu+mxWh7kFVODnQDb2McIQq0G7oEIYsSI/kogJd6xKOJfnr6x8d5F8h
9ysb8KJi0gBUuRJTPy7UYObrq9AuP0mJClmCMExQ17NQ5wZpEWWWSSIKh4WJ9T4Z
WqiCu8ZLVp+aTXm2awT0nRRE9/OIPDVYyhthJCkIV+FyDyR0oR0oNlWTeZNKyVeQ
2ri4BJdxx512XEDPI+SyEicH+RhlsW5TZYu4m0jtPVUNliKW6waGo/X668j4dWF+
/mXxa1XHDWSOg/OOGwkLJoDUiBRambPMaa5wxE7trJNCBPVZ1Mw=
=wuWf
-----END PGP SIGNATURE-----
Reply to: