GHSA-8r99-h8j2-rw64

Suggest an improvement
Source
https://github.com/advisories/GHSA-8r99-h8j2-rw64
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-8r99-h8j2-rw64/GHSA-8r99-h8j2-rw64.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-8r99-h8j2-rw64
Published
2022-10-07T07:31:33Z
Modified
2024-11-30T05:35:16.690034Z
Summary
Twisted vulnerable to HTTP Request Smuggling Attacks
Details

Impact

Twisted Web is vulnerable to request smuggling attacks:

  1. "When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 7230 Section 3.3.3#4, if a message is received with multiple content-length headers with differing value, then the server must reject the message with a 400 response." (Jake Miller of Bishop Fox Security)
  2. " When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted by Twisted Web as a pipelined request. According to RFC 7230 Section 3.3.3#3, if a message with both content-length and chunked encoding is accepted, transfer-encoding overrides the content-length." (Jake Miller of Bishop Fox Security)
  3. ~"Twisted should not allow BWS between the filed-name and colon." (ZeddYu Lu)~ closed in 9646
  4. "Two CL header with different values is also not allowed." (ZeddYu Lu)
  5. "Only accept identity and chunked Transport-Encoding." (ZeddYu Lu)

Patches

https://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081 https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281

Workarounds

N/A

References

https://portswigger.net/web-security/request-smuggling

Database specific 
{
    "github_reviewed": true,
    "severity": "MODERATE",
    "github_reviewed_at": "2022-10-07T07:31:33Z",
    "nvd_published_at": null,
    "cwe_ids": []
}
References

Affected packages

PyPI / twisted

Package

Name
twisted
View open source insights on deps.dev
Purl
pkg:pypi/twisted

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
20.3.0

Affected versions

1.*
1.0.1
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7
1.1.0
1.1.1
1.2.0
2.*
2.1.0
2.4.0
2.5.0
8.*
8.0.0
8.0.1
8.1.0
8.2.0
9.*
9.0.0
10.*
10.0.0
10.1.0
10.2.0
11.*
11.0.0
11.1.0
12.*
12.0.0
12.1.0
12.2.0
12.3.0
13.*
13.0.0
13.1.0
13.2.0
14.*
14.0.0
14.0.1
14.0.2
15.*
15.0.0
15.1.0
15.2.0
15.2.1
15.3.0
15.4.0
15.5.0
16.*
16.0.0
16.1.0
16.1.1
16.2.0
16.3.0
16.3.1
16.3.2
16.4.0
16.4.1
16.5.0rc1
16.5.0rc2
16.5.0
16.6.0rc1
16.6.0
16.7.0rc1
16.7.0rc2
17.*
17.1.0rc1
17.1.0
17.5.0
17.9.0rc1
17.9.0
18.*
18.4.0rc1
18.4.0
18.7.0rc1
18.7.0rc2
18.7.0
18.9.0rc1
18.9.0
19.*
19.2.0rc1
19.2.0rc2
19.2.0
19.2.1
19.7.0rc1
19.7.0
19.10.0rc1
19.10.0
20.*
20.3.0rc1

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/10/GHSA-8r99-h8j2-rw64/GHSA-8r99-h8j2-rw64.json"