Search for packages
| purl | pkg:pypi/twisted@1.0.4 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-31hv-tjeu-1ucm
Aliases: PYSEC-2019-58 |
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF. |
Affected by 12 other vulnerabilities. |
|
VCID-562c-1hjs-hqau
Aliases: CVE-2024-41810 GHSA-cf56-g6w6-pqq2 PYSEC-2024-75 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1. |
Affected by 0 other vulnerabilities. |
|
VCID-7d7z-nhf1-kyhc
Aliases: CVE-2020-10109 GHSA-p5xh-vx83-mxcj PYSEC-2020-260 |
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. |
Affected by 9 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-c98y-tdct-ykce
Aliases: CVE-2014-7143 GHSA-3c45-wgjp-7v9r PYSEC-2019-212 |
Python Twisted 14.0 trustRoot is not respected in HTTP client |
Affected by 15 other vulnerabilities. |
|
VCID-f9bv-6a83-eyb7
Aliases: PYSEC-2019-59 |
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections. |
Affected by 10 other vulnerabilities. |
|
VCID-n87q-79je-4kcj
Aliases: CVE-2016-1000111 GHSA-3gqj-cmxr-p4x2 PYSEC-2020-214 |
Twisted before 16.3.1 does not attempt to address RFC 3875 section 4.1.18 namespace conflicts and therefore does not protect CGI applications from the presence of untrusted client data in the HTTP_PROXY environment variable, which might allow remote attackers to redirect a CGI application's outbound HTTP traffic to an arbitrary proxy server via a crafted Proxy header in an HTTP request, aka an "httpoxy" issue. |
Affected by 14 other vulnerabilities. |
|
VCID-qavz-rft9-7bfb
Aliases: GHSA-32gv-6cf3-wcmq GMS-2022-410 |
HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities. |
Affected by 9 other vulnerabilities. |
|
VCID-qtwh-as1r-6ka5
Aliases: GHSA-8r99-h8j2-rw64 GMS-2022-5173 |
Twisted vulnerable to HTTP Request Smuggling Attacks ### Impact Twisted Web is vulnerable to request smuggling attacks: 1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 7230 Section 3.3.3#4, if a message is received with multiple content-length headers with differing value, then the server must reject the message with a 400 response." (Jake Miller of Bishop Fox Security) 2. " When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted by Twisted Web as a pipelined request. According to RFC 7230 Section 3.3.3#3, if a message with both content-length and chunked encoding is accepted, transfer-encoding overrides the content-length." (Jake Miller of Bishop Fox Security) 3. ~"Twisted should not allow BWS between the filed-name and colon." (ZeddYu Lu)~ _closed in 9646_ 4. "Two CL header with different values is also not allowed." (ZeddYu Lu) 5. "Only accept identity and chunked Transport-Encoding." (ZeddYu Lu) ### Patches https://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081 https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281 ### Workarounds N/A ### References https://portswigger.net/web-security/request-smuggling |
Affected by 6 other vulnerabilities. |
|
VCID-rzad-s8tu-47gm
Aliases: CVE-2022-24801 GHSA-c2jg-hw38-jrqq PYSEC-2022-195 |
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy. |
Affected by 4 other vulnerabilities. |
|
VCID-szfx-665h-w3eb
Aliases: CVE-2019-12855 GHSA-65rm-h285-5cc5 PYSEC-2019-129 |
In words.protocols.jabber.xmlstream in Twisted through 19.2.1, XMPP support did not verify certificates when used with TLS, allowing an attacker to MITM connections. |
Affected by 10 other vulnerabilities. |
|
VCID-tec3-uqmg-tueq
Aliases: CVE-2022-39348 GHSA-vg46-2rrj-3647 |
Multiple vulnerabilities have been discovered in Twisted, the worst of which could result in denial of service. |
Affected by 3 other vulnerabilities. |
|
VCID-vcw1-fzw7-43f5
Aliases: CVE-2020-10108 GHSA-h96w-mmrf-2h6v PYSEC-2020-259 |
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. |
Affected by 9 other vulnerabilities. Affected by 6 other vulnerabilities. |
|
VCID-vz8r-fhqf-zudf
Aliases: CVE-2024-41671 GHSA-c8m8-j448-xjx7 |
twisted.web has disordered HTTP pipeline response ### Summary The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. ### PoC 0. Start a fresh Debian container: ```sh docker run --workdir /repro --rm -it debian:bookworm-slim ``` 1. Install twisted and its dependencies: ```sh apt -y update && apt -y install ncat git python3 python3-pip \ && git clone --recurse-submodules https://github.com/twisted/twisted \ && cd twisted \ && pip3 install --break-system-packages . ``` 2. Run a twisted.web HTTP server that echos received requests' methods. e.g., the following: ```python from twisted.web import server, resource from twisted.internet import reactor class TheResource(resource.Resource): isLeaf = True def render_GET(self, request) -> bytes: return b"GET" def render_POST(self, request) -> bytes: return b"POST" site = server.Site(TheResource()) reactor.listenTCP(80, site) reactor.run() ``` 3. Send it a POST request with a chunked message body, pipelined with another POST request, wait a second, then send a GET request on the same connection: ```sh (printf 'POST / HTTP/1.1\r\nTransfer-Encoding: chunked\r\n\r\n0\r\n\r\nPOST / HTTP/1.1\r\nContent-Length: 0\r\n\r\n'; sleep 1; printf 'GET / HTTP/1.1\r\n\r\n'; sleep 1) | nc localhost 80 ``` 4. Observe that the responses arrive out of order: ``` HTTP/1.1 200 OK Server: TwistedWeb/24.3.0.post0 Date: Tue, 09 Jul 2024 06:19:41 GMT Content-Length: 5 Content-Type: text/html POST HTTP/1.1 200 OK Server: TwistedWeb/24.3.0.post0 Date: Tue, 09 Jul 2024 06:19:42 GMT Content-Length: 4 Content-Type: text/html GET HTTP/1.1 200 OK Server: TwistedWeb/24.3.0.post0 Date: Tue, 09 Jul 2024 06:19:42 GMT Content-Length: 5 Content-Type: text/html POST ``` ### Impact See [GHSA-xc8x-vp79-p3wm](https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm). Further, for instances of twisted.web HTTP servers deployed behind reverse proxies that implement connection pooling, it may be possible for remote attackers to receive responses intended for other clients of the twisted.web server. |
Affected by 0 other vulnerabilities. |
|
VCID-y7f5-9nmg-w7b3
Aliases: CVE-2023-46137 GHSA-xc8x-vp79-p3wm PYSEC-2023-224 |
Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue. |
Affected by 2 other vulnerabilities. |
|
VCID-zx5n-czhy-6qgu
Aliases: CVE-2019-12387 GHSA-6cc5-2vg4-cc7m PYSEC-2019-128 |
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF. |
Affected by 12 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||