MGASA-2022-0168

Dashboard / Vulnerabilities / MGASA-2022-0168

MGASA-2022-0168

Summary: Updated python-twisted packages fix security vulnerability

Details: CVE-2022-21712: It was discovered that Twisted incorrectly filtered HTTP headers when clients are being redirected to another origin. A remote attacker could use this issue to obtain sensitive information. CVE-2022-21716: It was discovered that Twisted incorrectly processed SSH handshake data on connection establishments. A remote attacker could use this issue to cause Twisted to crash, resulting in a denial of service. GHSA-rv6r-3f5q-9rgx The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier. GHSA-c2jg-hw38-jrqq and CVE-2022-24801 The Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than permitted by RFC 7230 GHSA-92x2-jw7w-xvvx: twisted.web.client.getPage, twisted.web.client.downladPage, and the associated implementation classes (HTTPPageGetter, HTTPPageDownloader, HTTPClientFactory, HTTPDownloader) have been removed because they do not segregate cookies by domain. They were deprecated in Twisted 16.7.0 in favor of twisted.web.client.Agent.

References: https://advisories.mageia.org/MGASA-2022-0168.html, https://bugs.mageia.org/show_bug.cgi?id=30067, https://lists.suse.com/pipermail/sle-security-updates/2022-February/010263.html, https://www.debian.org/lts/security/2022/dla-2927, https://lists.opensuse.org/archives/list/[email protected]/thread/233XDDM6URC3DPBBAKQV2AZQY6TBXJRV/, https://www.debian.org/lts/security/2022/dla-2938, https://ubuntu.com/security/notices/USN-5354-1, https://lists.opensuse.org/archives/list/[email protected]/thread/HJFVJUKPT7GYOWBWGQSIVM3OEHKOEVVJ/