UBUNTU-CVE-2022-21716

    Dashboard / Vulnerabilities / UBUNTU-CVE-2022-21716

    UBUNTU-CVE-2022-21716

    Published: 3 Mar 2022Last Modified: 4 Feb 2026
    Upstream:
    CVE-2022-21716

    Summary:

    Details: Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

    References: https://ubuntu.com/security/CVE-2022-21716, https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9, https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx, https://twistedmatrix.com/trac/ticket/10284, https://github.com/twisted/twisted/releases/tag/twisted-22.2.0, https://ubuntu.com/security/notices/USN-5354-1, https://ubuntu.com/security/notices/USN-5354-2, https://www.cve.org/CVERecord?id=CVE-2022-21716

    Affected packages

    Package

    Name: twisted

    Purl: pkg:deb/ubuntu/[email protected]+esm2?arch=source&distro=trusty/esm

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -13.2.0-1ubuntu1.2+esm2

    Affected versions

    13.0.0-1ubuntu1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    UBUNTU-CVE-2022-21716 | CVE-DB