Source: twisted Version: 18.9.0-6 Severity: important Tags: security upstream Control: found -1 19.10.0~rc1-1 Control: found -1 18.9.0-3 Control: found -1 16.6.0-2
Hi, The following vulnerabilities were published for twisted. CVE-2020-10108[0]: | In Twisted Web through 19.10.0, there was an HTTP request splitting | vulnerability. When presented with two content-length headers, it | ignored the first header. When the second content-length value was set | to zero, the request body was interpreted as a pipelined request. CVE-2020-10109[1]: | In Twisted Web through 19.10.0, there was an HTTP request splitting | vulnerability. When presented with a content-length and a chunked | encoding header, the content-length took precedence and the remainder | of the request body was interpreted as a pipelined request. If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2020-10108 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10108 [1] https://security-tracker.debian.org/tracker/CVE-2020-10109 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10109 [2] https://know.bishopfox.com/advisories/twisted-version-19.10.0#INOR Regards, Salvatore
