PT-2019-5686 · Twisted+6 · Twisted Web+6

Published 2019-05-12 · Updated 2025-03-26 · CVE-2020-10108

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Twisted Web versions prior to 20.3.0

Description The issue is related to insufficient input validation when handling HTTP headers, which can lead to an HTTP request splitting vulnerability. When presented with two content-length headers, the first header is ignored. If the second content-length value is set to zero, the request body is interpreted as a pipelined request. This can potentially allow a remote attacker to cause a denial of service.

Recommendations For Twisted Web versions prior to 20.3.0, update to version 20.3.0 or later to resolve the issue. As a temporary workaround, consider restricting the handling of multiple content-length headers to prevent request splitting.

Exploit

Fix

HTTP Request/Response Smuggling

RCE

Weakness Enumeration

CWE-444

CWE-20

Related Identifiers

AZL-6819

BDU:2020-05644

CESA-2020_1561

CESA-2020_1962

CVE-2020-10108

DLA-2145-1

DLA-2145-2

DLA-2927-1

GHSA-H96W-MMRF-2H6V

MGASA-2020-0428

OPENSUSE-SU-2024:11041-1

PYSEC-2020-259

RHSA-2020:1561

RHSA-2020:1962

RHSA-2020_1561

RHSA-2020_1962

SUSE-SU-2022:2811-1

SUSE-SU-2022:4074-1

SUSE-SU-2022_2811-1

USN-4308-1

USN-4308-2

Affected Products

Astra Linux

Centos

Red Hat

Red Os

Suse

Twisted Web

Ubuntu

References · 82

• 🔥 https://know.bishopfox.com/advisories · Exploit
• https://bdu.fstec.ru/vul/2020-05644 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2022-1121SE47 · Vendor Advisory
• https://osv.dev/vulnerability/USN-4308-2 · Vendor Advisory
• https://security.gentoo.org/glsa/202007-24 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2022:2811-1 · Vendor Advisory
• https://osv.dev/vulnerability/PYSEC-2020-259 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10108 · Security Note
• https://ubuntu.com/security/CVE-2019-12387 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-4308-2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-10109 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2020-1962.html · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11041-1 · Vendor Advisory