GitHub Advisoryadvisory · PyPI

GHSA-h96w-mmrf-2h6v Improper Input Validation in Twisted

CRITICAL Published 2020-03-31 Modified 2024-11-25 Official page ↗
Aliases
CVE-2020-10108
Ecosystem
PyPI
Packages
Twisted
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-444
Reviewed
2020-03-31

Affected packages

• PyPI Twisted: < 20.3.0 → fixed in 20.3.0

Description

In Twisted Web before 20.3.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.

Related

Alias · CVE (1)

  • CVE-2020-10108 In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-444 Inconsistent Interpretation of HTTP Requests weakness

References