Skip to content
OpenAdvisories
High ELSA-2020-1561 2 CVEs

Important: python-twisted-web security update (Oracle Linux 7)

Published Apr 23, 2020 · Updated Apr 23, 2020

Ecosystem: Oracle Linux

Summary

[12.1.0-7]
- Fix CVE-2020-10108 and CVE-2020-10109 multiple HTTP request smuggling vulnderabilities
Resolves: rhbz#1813439 rhbz#1813447
- Remove useless macros definitions

Fixed packages 1

ReleasePackageFixed in
Oracle Linux · 7 python-twisted-web 0:12.1.0-7.el7_8

Vulnerabilities 2

  • Critical 9.8
    CVE-2020-10108

    Improper Input Validation in Twisted

    In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelin…

    twisted twisted twisted python-twisted Debian Ubuntu Azure Linux Alpine PyPI
  • Critical 9.8
    CVE-2020-10109

    HTTP Request Smuggling in Twisted

    In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined requ…

    twisted twisted twisted python-twisted Debian Ubuntu Azure Linux Alpine PyPI