Skip to content
OpenAdvisories
High ALAS2-2022-1827 1 CVE

Important: python-twisted-web security update (Amazon Linux 2)

Published Jul 19, 2022 · Updated Jul 20, 2022

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2022-24801: A flaw was found in python-twisted. This vulnerability occurs due to the parsing of illegal constructs in the twisted.web.http module. The illegal constructs include '+/-' in the Content-Length header, '\n and \t' etc. Non-conformant parsing leads to a desync if requests pass through multiple HTTP parsers. This flaw allows a remote attacker to perform an HTTP request smuggling attack.

Fixed packages 1

ReleasePackageFixed in
Amazon Linux · 2 python-twisted-web 0:12.1.0-8.amzn2

Vulnerabilities 1

  • High 8.1
    CVE-2022-24801

    HTTP Request Smuggling in twisted.web

    Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted …

    twisted twisted twisted twisted Debian Ubuntu Alpine PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2022-24801.html