Skip to content
OpenAdvisories
High ALAS2-2020-1428 2 CVEs

Important: python-twisted-web security update (Amazon Linux 2)

Published May 19, 2020 · Updated May 20, 2020

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2020-10109: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. 1813447: CVE-2020-10109 python-twisted: HTTP request smuggling when presented with a Content-Length and a chunked Transfer-Encoding header CVE-2020-10108: In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. 1813439: CVE-2020-10108 python-twisted: HTTP request smuggling when presented with two Content-Length headers

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 python-twisted-web 0:12.1.0-7.amzn2

Vulnerabilities 2

  • Critical 9.8

    Improper Input Validation in Twisted

    In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelin…

  • Critical 9.8

    HTTP Request Smuggling in Twisted

    In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined requ…

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-10108.html
  • web
    https://alas.aws.amazon.com/cve/html/CVE-2020-10109.html