GitHub Advisoryadvisory · PyPI

GHSA-6cc5-2vg4-cc7m Twisted CRLF Injection

MEDIUM Published 2019-06-10 Modified 2024-11-25 Official page ↗
Aliases
CVE-2019-12387
Ecosystem
PyPI
Packages
twisted
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-74, CWE-93
Reviewed
2019-06-10

Affected packages

• PyPI twisted: < 19.2.1 → fixed in 19.2.1

Description

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.

Related

Alias · CVE (1)

  • CVE-2019-12387 In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters… vulnerability

Weakness · CWE (2)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness
  • CWE-93 Improper Neutralization of CRLF Sequences weakness

References