Skip to content
OpenAdvisories
Medium ALAS2023-2023-432 1 CVE

Moderate: python-twisted security update (Amazon Linux 2023)

Published Nov 9, 2023 · Updated Nov 14, 2023

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2023-46137: Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2023 python3-twisted 0:22.4.0-126.amzn2023.0.3
Amazon Linux · 2023 python3-twisted+tls 0:22.4.0-126.amzn2023.0.3

Vulnerabilities 1

  • Medium 5.3
    CVE-2023-46137

    twisted.web has disordered HTTP pipeline response

    Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endp…

    twisted twisted twisted twisted Debian Ubuntu Azure Linux PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2023-46137.html