PT-2019-2639 · Twisted Matrix Laboratories+5 · Twisted+5

Published 2019-06-06 · Updated 2024-11-25 · CVE-2019-12387

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Twisted versions prior to 19.2.1

Description The issue exists due to insufficient input validation in the twisted.web component of the Twisted network framework. This allows a remote attacker to impact the confidentiality and integrity of protected information by injecting invalid characters, such as CRLF, into URIs or HTTP methods.

Recommendations For versions prior to 19.2.1, update to version 19.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to the twisted.web component to minimize the risk of exploitation. Avoid using the twisted.web module in sensitive operations until the issue is resolved.

Exploit

Fix

Special Elements Injection

RCE

Weakness Enumeration

CWE-74

CWE-93

CWE-20

Related Identifiers

BDU:2019-02525

CESA-2020_1091

CVE-2019-12387

GHSA-6CC5-2VG4-CC7M

MGASA-2019-0360

OPENSUSE-SU-2019:1760-1

OPENSUSE-SU-2019:1785-1

OPENSUSE-SU-2019_1760-1

OPENSUSE-SU-2024:11212-1

PYSEC-2019-128

RHSA-2019:3172

RHSA-2020:1091

RHSA-2020_1091

SUSE-SU-2019:1731-1

SUSE-SU-2019:2066-1

SUSE-SU-2019_1731-1

SUSE-SU-2019_2066-1

SUSE-SU-2022:4074-1

SUSE-SU-2022_4074-1

USN-4308-1

USN-4308-2

Affected Products

Astra Linux

Centos

Red Hat

Suse

Twisted

Ubuntu

References · 60

• 🔥 https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.html · Exploit
• 🔥 https://labs.twistedmatrix.com/2019/06/twisted-1921-released.html · Exploit
• https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2 · Patch
• https://osv.dev/vulnerability/GHSA-6cc5-2vg4-cc7m · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N · Vendor Advisory
• https://advisories.mageia.org/MGASA-2019-0360.html · Security Note
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-12387 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2019-12387 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10108 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4308-2 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://ubuntu.com/security/CVE-2019-9514 · Vendor Advisory