twisted@22.2.0rc1 vulnerabilities

An asynchronous networking framework written in Python

latest version

24.11.0

latest non vulnerable version

first published

19 years ago

latest version published

4 months ago

licenses detected

MIT
[2.1.0,)

View twisted package health on Snyk Advisor (opens in a new tab)

Go back to all versions of this package

Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the twisted package. This does not include vulnerabilities belonging to this package’s dependencies.

How to fix?

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.

Vulnerability	Vulnerable Version
M HTTP Response Smuggling Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to HTTP Response Smuggling. When sending multiple HTTP/1.1 requests in one TCP segment, twisted.web does not guarantee the response order. An attacker in control of an endpoint can manipulate a different user's second response to a pipelined chunked request by delaying the response to their own request. Information disclosure across sessions may also be possible for reverse proxy servers using pooled connections. How to fix HTTP Response Smuggling? Upgrade `Twisted` to version 24.7.0rc1 or higher.	[16.3.0,24.7.0rc1)
M Cross-site Scripting (XSS) Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Cross-site Scripting (XSS) when the victim is using Firefox, due to an unescaped URL in the `redirectTo()` function. A site which is vulnerable to open redirects by other means can be can be made to execute scripts injected into a redirect URL. How to fix Cross-site Scripting (XSS)? Upgrade `Twisted` to version 24.7.0rc1 or higher.	[,24.7.0rc1)
M HTTP Response Smuggling Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to HTTP Response Smuggling. When sending multiple HTTP/1.1 requests in one TCP segment, twisted.web does not guarantee the response order. An attacker in control of an endpoint can manipulate a different user's second response to a pipelined chunked request by delaying the response to their own request. How to fix HTTP Response Smuggling? Upgrade `Twisted` to version 23.10.0rc1 or higher.	[16.3.0,23.10.0rc1)
M HTTP Header Injection Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to HTTP Header Injection via the `NameVirtualHost` function. When the host header does not match a configured host, `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. How to fix HTTP Header Injection? Upgrade `Twisted` to version 22.10.0rc1 or higher.	[,22.10.0rc1)
M HTTP Request Smuggling Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to HTTP Request Smuggling in the `twisted.web.http` module which makes non-conformant parsing and can lead to desync if requests pass through multiple HTTP parsers. Note: To be vulnerable, applications need to both use Twisted Web's HTTP server/proxy, along with some other HTTP server/proxy. How to fix HTTP Request Smuggling? Upgrade `Twisted` to version 22.4.0rc1 or higher.	[,22.4.0rc1)
H Denial of Service (DoS) Twisted is an event-based network programming and multi-protocol integration framework. Affected versions of this package are vulnerable to Denial of Service (DoS) by accepting an infinite amount of data for the peer's SSH version identifier. it is possible to be exploited via SSH transport due to a lack of validation for user data. The attack is as simple as `nc -rv localhost 22 < /dev/zero`. How to fix Denial of Service (DoS)? Upgrade `Twisted` to version 22.2.0 or higher.	[22.1.0,22.2.0)

Go back to all versions of this package