Vulnerability · Published Jul 29, 2024 · Assigned by GitHub_M
CVE-2024-41671twisted.web has disordered HTTP pipeline response
High 8.3
In plain English
A high-severity security flaw in twisted from twisted. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 59% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)8.3High
Exploit odds (30 days)0.9%top 41.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine:v3.20 | synapse | 1.112.0-r0 | ALPINE-CVE-2024-41671 |
| Alpine:v3.21 | synapse | 1.112.0-r0 | ALPINE-CVE-2024-41671 |
| Alpine:v3.22 | synapse | 1.112.0-r0 | ALPINE-CVE-2024-41671 |
| Alpine:v3.23 | synapse | 1.112.0-r0 | ALPINE-CVE-2024-41671 |
| Alpine:v3.24 | synapse | 1.112.0-r0 | ALPINE-CVE-2024-41671 |
| Debian:12 | twisted | 22.4.0-4+deb12u1 | DEBIAN-CVE-2024-41671 |
| Debian:12 | twisted | 22.4.0-4+deb12u1 | DSA-5797-1 |
| Debian:13 | twisted | 24.7.0-1 | DEBIAN-CVE-2024-41671 |
| Debian:14 | twisted | 24.7.0-1 | DEBIAN-CVE-2024-41671 |
| PyPI | twisted | 24.7.0rc1 | GHSA-c8m8-j448-xjx7 |
| PyPI | twisted | 24.7.0rc1 | PYSEC-2026-1992 |
| Ubuntu:22.04:LTS | twisted | 22.1.0-2ubuntu2.5 | USN-6988-1 |
| Ubuntu:22.04:LTS | twisted | 22.1.0-2ubuntu2.6 | USN-6988-2 |
| Ubuntu:22.04:LTS | twisted | 22.1.0-2ubuntu2.6 | UBUNTU-CVE-2024-41671 |
| Ubuntu:24.04:LTS | twisted | 24.3.0-1ubuntu0.1 | UBUNTU-CVE-2024-41671 |
| Ubuntu:24.04:LTS | twisted | 24.3.0-1ubuntu0.1 | USN-6988-1 |
Affected products (as reported)
Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
References
- https://github.com/twisted/twisted/security/advisories/GHSA-c8m8-j448-xjx7 x_refsource_CONFIRM
- https://github.com/twisted/twisted/commit/046a164f89a0f08d3239ecebd750360f8914df33 x_refsource_MISC
- https://github.com/twisted/twisted/commit/4a930de12fb67e88fefcb8822104152f42b27abc x_refsource_MISC
- https://www.vicarius.io/vsociety/posts/disordered-http-pipeline-in-twistedweb-cve-2024-4167
- https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html