Published: 12/03/2020 Updated: 07/11/2023

CVSS v2 Base Score: 7.5 | Impact Score: 6.4 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 668

Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P

In Twisted Web up to and including 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.

Vulnerable Product	Search on Vulmon	Subscribe to Product
twistedmatrix twisted
fedoraproject fedora 31
fedoraproject fedora 32
debian debian linux 9.0
canonical ubuntu linux 18.04
canonical ubuntu linux 14.04
canonical ubuntu linux 19.10
canonical ubuntu linux 16.04

Synopsis Important: python-twisted-web security update Type/Severity Security Advisory: Important Topic An update for python-twisted-web is now available for Red Hat Enterprise Linux 7Red Hat Product Security has rated this update as having a security impact of Important A Common Vulnerability Scoring Sys ...

Debian Bug report logs - #953950 twisted: CVE-2020-10108 CVE-2020-10109 Package: src:twisted; Maintainer for src:twisted is Debian Python Modules Team <python-modules-team@listsaliothdebianorg>; Reported by: Salvatore Bonaccorso <carnil@debianorg> Date: Sat, 14 Mar 2020 21:57:07 UTC Severity: important Tags: secu ...

Several security issues were fixed in Twisted ...

In Twisted Web through 19100, there was an HTTP request splitting vulnerability When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request (CVE-2020-10109) In Twisted Web through 19100, there was an HTTP request splitting v ...

CWE-444 https://know.bishopfox.com/advisories/twisted-version-19.10.0 https://know.bishopfox.com/advisories https://usn.ubuntu.com/4308-1/https://usn.ubuntu.com/4308-2/https://security.gentoo.org/glsa/202007-24 https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/https://access.redhat.com/errata/RHSA-2020:1561 https://nvd.nist.gov https://usn.ubuntu.com/4308-2/

CVE-2020-10109

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect