PT-2021-7398 · Twisted+5 · Twisted+5
Published
2021-12-24
·
Updated
2025-09-22
·
CVE-2022-21716
CVSS v4.0
8.7
High
| Vector | AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N |
Name of the Vulnerable Software and Affected Versions
Twisted versions prior to 22.2.0
Description
The Twisted SSH client and server implementation is vulnerable to a denial of service attack due to its ability to accept an infinite amount of data for the peer's SSH version identifier, resulting in a buffer using all available memory. A malicious peer can craft a request that crashes the server. The attack can be as simple as using
nc -rv localhost 22 < /dev/zero.Recommendations
For versions prior to 22.2.0, update to version 22.2.0 to resolve the issue.
As a temporary workaround, consider limiting access to the SSH server to only trusted source IP addresses.
Additionally, connect over SSH only to trusted destination IP addresses to minimize the risk of exploitation.
Exploit
Fix
DoS
Allocation of Resources Without Limits
Buffer Overflow
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Astra Linux
Linuxmint
Red Os
Suse
Twisted
Ubuntu