Summary
Ben Kallus discovered that Twisted incorrectly handled response order when
processing multiple HTTP requests. A remote attacker could possibly use
this issue to delay and manipulate responses.
This issue only affected Ubuntu 24.04 LTS. (CVE-2024-41671)
It was discovered that Twisted did not properly sanitize certain input.
An attacker could use this vulnerability to possibly execute an HTML
injection leading to a cross-site scripting (XSS) attack.
(CVE-2024-41810)
Fixed packages 6
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 20.04 LTS 20.04:LTS | twisted | 18.9.0-11ubuntu0.20.04.4 |
| Ubuntu · 22.04 LTS 22.04:LTS | twisted | 22.1.0-2ubuntu2.5 |
| Ubuntu · 24.04 LTS 24.04:LTS | twisted | 24.3.0-1ubuntu0.1 |
| Ubuntu · Pro 14.04 LTS Pro:14.04:LTS | twisted | 13.2.0-1ubuntu1.2+esm3 |
| Ubuntu · Pro 16.04 LTS Pro:16.04:LTS | twisted | 16.0.0-1ubuntu0.4+esm2 |
| Ubuntu · Pro 18.04 LTS Pro:18.04:LTS | twisted | 17.9.0-2ubuntu0.3+esm1 |
Vulnerabilities 2
-
High 8.3
twisted.web has disordered HTTP pipeline response
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is …
-
Medium 6.1CVE-2024-41810 Scanner template
HTML injection in HTTP redirect body
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability m…