Log in Start free

Vulnerability · Published Mar 12, 2020 · Assigned by mitre

CVE-2020-10109

Critical 9.8

In plain English

A critical-severity security flaw in the py3-twisted package (Alpine). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.3% (higher than 89% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)3.3%top 11.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20py3-twisted20.3.0-r0ALPINE-CVE-2020-10109
Alpine:v3.21py3-twisted20.3.0-r0ALPINE-CVE-2020-10109
Alpine:v3.22py3-twisted20.3.0-r0ALPINE-CVE-2020-10109
Alpine:v3.23py3-twisted20.3.0-r0ALPINE-CVE-2020-10109
Alpine:v3.24py3-twisted20.3.0-r0ALPINE-CVE-2020-10109
Debian:12twisted18.9.0-7DEBIAN-CVE-2020-10109
Debian:13twisted18.9.0-7DEBIAN-CVE-2020-10109
Debian:14twisted18.9.0-7DEBIAN-CVE-2020-10109
PyPItwisted20.3.0rc1PYSEC-2020-260
PyPItwisted20.3.0GHSA-p5xh-vx83-mxcj

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References