Published: 12/03/2020 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

In Twisted Web up to and including 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
twistedmatrix twisted
fedoraproject fedora 31
fedoraproject fedora 32
debian debian linux 9.0
canonical ubuntu linux 18.04
canonical ubuntu linux 14.04
canonical ubuntu linux 19.10
canonical ubuntu linux 16.04
oracle solaris 11
oracle solaris 10
oracle zfs storage appliance kit 8.8

Debian Bug report logs - #953950 twisted: CVE-2020-10108 CVE-2020-10109 Package: src:twisted; Maintainer for src:twisted is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 14 Mar 2020 21:57:07 UTC Severity: important Tags: secu ...

Synopsis Important: python-twisted-web security update Type/Severity Security Advisory: Important Topic An update for python-twisted-web is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...

Synopsis Important: python-twisted-web security update Type/Severity Security Advisory: Important Topic An update for python-twisted-web is now available for Red Hat Enterprise Linux 6Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...

Several security issues were fixed in Twisted ...

In Twisted Web through 19100, there was an HTTP request splitting vulnerability When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request (CVE-2020-10109) In Twisted Web through 19100, there was an HTTP request splitting v ...

In Twisted Web through 19100, there was an HTTP request splitting vulnerability When presented with two content-length headers, it ignored the first header When the second content-length value was set to zero, the request body was interpreted as a pipelined request(CVE-2020-10108) ...

CWE-444 https://know.bishopfox.com/advisories/twisted-version-19.10.0 https://know.bishopfox.com/advisories https://usn.ubuntu.com/4308-1/https://usn.ubuntu.com/4308-2/https://security.gentoo.org/glsa/202007-24 https://www.oracle.com/security-alerts/cpuoct2020.html https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=953950 https://nvd.nist.gov https://usn.ubuntu.com/4308-2/

CVE-2020-10108

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect