Debian alert DLA-2927-1 (twisted)

From:
             
 
Sylvain Beucler <beuc@beuc.net>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA 2927-1] twisted security update
Date:
             
 
Sat, 19 Feb 2022 17:30:59 +0100
Message-ID:
             
 
<20220219163059.GA6011@mail.beuc.net>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-2927-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                      Sylvain Beucler
February 19, 2022                             https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : twisted
Version        : 16.6.0-2+deb9u1
CVE ID         : CVE-2020-10108 CVE-2020-10109 CVE-2022-21712
Debian Bug     : 953950

It was discovered that Twisted, a Python event-based framework for
internet applications, is affected by HTTP request splitting
vulnerabilities, and may expose sensitive data when following
redirects. An attacker may bypass validation checks and retrieve
credentials.

CVE-2020-10108

    HTTP request splitting vulnerability. When presented with two
    content-length headers, it ignored the first header. When the
    second content-length value was set to zero, the request body was
    interpreted as a pipelined request.

CVE-2020-10109

    HTTP request splitting vulnerability. When presented with a
    content-length and a chunked encoding header, the content-length
    took precedence and the remainder of the request body was
    interpreted as a pipelined request.

CVE-2022-21712

    Twisted exposes cookies and authorization headers when following
    cross-origin redirects. This issue is present in the
    `twisted.web.RedirectAgent` and
    `twisted.web.BrowserLikeRedirectAgent` functions.

For Debian 9 stretch, these problems have been fixed in version
16.6.0-2+deb9u1.

We recommend that you upgrade your twisted packages.

For the detailed security status of twisted please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/twisted

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmIRF3oACgkQDTl9HeUl
XjCVPA//fL6aqybmO5RiIoiLmx/69dncWCB9TnVLJ/uhO3UN8DszHeWCG85cNnZL
DLxKLq2nqpQZ5q7AX5g1dIxsZyGvFSWHgbHEaPqgTmM9I61X93vmzLFK1cqVqFI2
LKiGbDVCTJh70IySLI42D/7uNDsZmAdIsB4PrcjDOk4MwDa20SjKC8c2qmxpKpBM
9DkJJ0OkIzN5OIAP2/iJDiXF+kv0iJeOaOdINcbXwAXhB7hk7MpznG91VKiBazSs
VcwK+3QURFLufNK2wf1r4jTLQa03BNrUN31S+H7V8whNnYOCPGVXcNqdQL/mHm7N
/EFiQ253k5F+FS6ZVROpTtlqH7NVhm3vWNBHmEc+nGSNmAWh/4INITl1kYlLMoKf
W3u43cE7+fu+mxWh7kFVODnQDb2McIQq0G7oEIYsSI/kogJd6xKOJfnr6x8d5F8h
9ysb8KJi0gBUuRJTPy7UYObrq9AuP0mJClmCMExQ17NQ5wZpEWWWSSIKh4WJ9T4Z
WqiCu8ZLVp+aTXm2awT0nRRE9/OIPDVYyhthJCkIV+FyDyR0oR0oNlWTeZNKyVeQ
2ri4BJdxx512XEDPI+SyEicH+RhlsW5TZYu4m0jtPVUNliKW6waGo/X668j4dWF+
/mXxa1XHDWSOg/OOGwkLJoDUiBRambPMaa5wxE7trJNCBPVZ1Mw=
=wuWf
-----END PGP SIGNATURE-----