PYSEC-2022-160

    Dashboard / Vulnerabilities / PYSEC-2022-160

    PYSEC-2022-160

    Published: 3 Mar 2022Last Modified: 8 Nov 2023

    Summary:

    Details: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

    References: https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9, https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx, https://twistedmatrix.com/trac/ticket/10284, https://github.com/twisted/twisted/releases/tag/twisted-22.2.0

    Affected packages

    Package

    Name: twisted

    Purl: pkg:pypi/twisted

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -89c395ee794e85a9657b112c4351417850330ef9

    Affected versions

    21.7.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    PYSEC-2022-160 | CVE-DB