Log in Start free

Vulnerability · Published Apr 4, 2022 · Assigned by GitHub_M

CVE-2022-24801HTTP Request Smuggling in twisted.web

High 8.1

In plain English

A high-severity security flaw in twisted from twisted. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 2.8% (higher than 87% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)2.8%top 13.5% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Alpine:v3.20py3-twisted22.4.0-r0ALPINE-CVE-2022-24801
Alpine:v3.21py3-twisted22.4.0-r0ALPINE-CVE-2022-24801
Alpine:v3.22py3-twisted22.4.0-r0ALPINE-CVE-2022-24801
Alpine:v3.23py3-twisted22.4.0-r0ALPINE-CVE-2022-24801
Alpine:v3.24py3-twisted22.4.0-r0ALPINE-CVE-2022-24801
Debian:12twisted22.4.0-1DEBIAN-CVE-2022-24801
Debian:13twisted22.4.0-1DEBIAN-CVE-2022-24801
Debian:14twisted22.4.0-1DEBIAN-CVE-2022-24801
PyPItwisted22.4.0PYSEC-2022-195
PyPItwisted22.4.0GHSA-c2jg-hw38-jrqq
Ubuntu:22.04:LTStwisted22.1.0-2ubuntu2.3UBUNTU-CVE-2022-24801
Ubuntu:22.04:LTStwisted22.1.0-2ubuntu2.3USN-5576-1

Affected products (as reported)

VendorProductVersions
twisted twisted <= 22.2.0

Weakness: CWE-444 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

References