AZL-8505
Dashboard / Vulnerabilities / AZL-8505
Summary: CVE-2022-21712 affecting package python-twisted for versions less than 22.2.0-1
Details: twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.
References: https://nvd.nist.gov/vuln/detail/CVE-2022-21712
Affected packages
Package
Name: python-twisted
Purl: pkg:rpm/azure-linux/python-twisted
Affected ranges
Type: ECOSYSTEM
Events:
Introduced- 0
Fixed -22.2.0-1
Affected versions
Common Vulnerability Scoring System
Attack Vector
Network
Adjacent
Local
Physical
Privileges Required
None
Low
High
User Interaction
None
Required
Scope
Unchanged
Changed
Confidentiality
None
Low
High
Integrity
None
Low
High
Availability
None
Low
High
