PT-2019-5686 · Twisted+6 · Twisted Web+6

Publicado 2019-05-12 · Atualizado 2025-03-26 · CVE-2020-10108

Positive Technologies (AI Summary)

CVSS v2.0

10

Crítica

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Twisted Web versions prior to 20.3.0

Description The issue is related to insufficient input validation when handling HTTP headers, which can lead to an HTTP request splitting vulnerability. When presented with two content-length headers, the first header is ignored. If the second content-length value is set to zero, the request body is interpreted as a pipelined request. This can potentially allow a remote attacker to cause a denial of service.

Recommendations For Twisted Web versions prior to 20.3.0, update to version 20.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the handling of multiple content-length headers to prevent request splitting.

Exploit

Correção

HTTP Request/Response Smuggling

RCE

Enumeração de Fraquezas

CWE-444

CWE-20

Identificadores relacionados

AZL-6819

BDU:2020-05644

CESA-2020_1561

CESA-2020_1962

CVE-2020-10108

DLA-2145-1

DLA-2145-2

DLA-2927-1

GHSA-H96W-MMRF-2H6V

MGASA-2020-0428

OPENSUSE-SU-2024:11041-1

PYSEC-2020-259

RHSA-2020:1561

RHSA-2020:1962

RHSA-2020_1561

RHSA-2020_1962

SUSE-SU-2022:2811-1

SUSE-SU-2022:4074-1

SUSE-SU-2022_2811-1

USN-4308-1

USN-4308-2

Produtos afetados

Astra Linux

Centos

Red Hat

Red Os

Suse

Twisted Web

Ubuntu

Referências · 82

• 🔥 https://know.bishopfox.com/advisories · Exploit
• https://github.com/twisted/twisted · Nota
• https://github.com/twisted/twisted/blob/6ff2c40e42416c83203422ff70dfc49d2681c8e2/NEWS.rst#twisted-2030-2020-03-13 · Nota
• https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281 · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2020-259.yaml · Nota
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.4.2 · Nota
• https://suse.com/security/cve/CVE-2019-12387 · Nota
• https://suse.com/security/cve/CVE-2020-26257 · Nota
• https://bugzilla.suse.com/1166458 · Nota
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-python3-twisted-cve-2020-10108-cve-2020-10109 · Nota
• https://bdu.fstec.ru/vul/2020-05644 · Nota de Segurança
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL · Aviso do Fabricante
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Aviso do Fabricante
• https://osv.dev/vulnerability/USN-4308-2 · Aviso do Fabricante
• https://security.gentoo.org/glsa/202007-24 · Aviso do Fabricante