Logo
vulnerabilityCVE-2022-24801
Name
CVE-2022-24801
Source
NVD ( link)Debian ( link)
Description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.
Published Date
Updated Date
Workaround
-

Analysis#


Affected Component
Analysis
python3-twisted
Patched

Vulnerability Ratings#


8.1
CVSSv31
8.1
CVSSv31
6.8
CVSSv2
NaN
other

Others affected component#


Name
Project
Project Version
Version
Status
yocto
scarthgap
24.3.0
Not Affected

Resolved with patches#


python3-twisted (yocto:kirkstone)

#
Title
Author
Resolve
1
Remove unreachable branch
Tom Most <twm@freecog.net>
CVE-2022-24801
2
Strip only spaces and tabs from header values
Tom Most <twm@freecog.net>
CVE-2022-24801
3
Test for malformed chunk size and extensions
Tom Most <twm@freecog.net>
CVE-2022-24801
4
Reject non-digit Content-Length
Tom Most <twm@freecog.net>
CVE-2022-24801
5
Some tests for GHSA-c2jg-hw38-jrqq
Tom Most <twm@freecog.net>
CVE-2022-24801
6
Reject malformed chunk sizes
Tom Most <twm@freecog.net>
CVE-2022-24801
7
Replace obs-fold with a single space
Tom Most <twm@freecog.net>
CVE-2022-24801
8
Correct chunk extension byte validation
Tom Most <twm@freecog.net>
CVE-2022-24801
9
Address review feedback
Tom Most <twm@freecog.net>
CVE-2022-24801