Skip to content
OpenAdvisories
Medium ALAS2023-2024-746 1 CVE

Moderate: python-twisted security update (Amazon Linux 2023)

Published Oct 24, 2024 · Updated Oct 31, 2024

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2024-41810: Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.

Fixed packages 2

ReleasePackageFixed in
Amazon Linux · 2023 python3-twisted 0:22.4.0-127.amzn2023.0.4
Amazon Linux · 2023 python3-twisted+tls 0:22.4.0-127.amzn2023.0.4

Vulnerabilities 1

  • Medium 6.1
    CVE-2024-41810 Scanner template

    HTML injection in HTTP redirect body

    Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability m…

    twisted twisted twisted twisted Debian Ubuntu Azure Linux PyPI

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2024-41810.html