Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-twisted) security update

Fixed packages 4

Vulnerabilities 2

• High 7.5
  CVE-2022-21712

  Cookie and header exposure in twisted

  twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLike…

  twisted twisted twisted twisted Debian Ubuntu Azure Linux Alpine PyPI
  Feb 7, 2022
• High 7.5
  CVE-2022-21716

  Buffer Overflow in Twisted

  Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer usin…

  twisted twisted twisted twisted Debian Ubuntu Alpine PyPI
  Mar 3, 2022

References

• article
  https://access.redhat.com/security/updates/classification/#important
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2051865
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=2060960
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0992.json
• report
  https://access.redhat.com/security/cve/CVE-2022-21712
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-21712
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-21712
• article
  https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx
• report
  https://access.redhat.com/security/cve/CVE-2022-21716
• advisory
  https://www.cve.org/CVERecord?id=CVE-2022-21716
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2022-21716