Description
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| twisted | twisted | >= 0.9.4, < 22.10.0rc1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | twisted | 22.4.0-4 | — |
| Debian 13 | twisted | 22.4.0-4 | — |
| Debian 12 | twisted | 22.4.0-4 | — |
| Debian 11 | twisted | 20.3.0-7+deb11u2 | DLA-3970-1 |
| Debian 10 | twisted | 18.9.0-3+deb10u2 | DLA-3212-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | twisted | 22.1.0-2ubuntu2.4 | USN-6575-1 |
| Ubuntu 20.04 LTS | twisted | 18.9.0-11ubuntu0.20.04.3 | USN-6575-1 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Pro 18.04 LTS | twisted | No fix yet | — |
| Ubuntu Pro 16.04 LTS | twisted | No fix yet | — |
| Ubuntu Pro 14.04 LTS | twisted | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP4 | python-Twisted | 22.2.0-150400.5.7.1 | SUSE-SU-2022:4000-1 |
| SLES 15 SP3 | python-Twisted | 19.10.0-150200.3.18.1 | SUSE-SU-2022:4057-1 |
| SLES 12 | python-Twisted | 15.2.1-9.23.1 | SUSE-SU-2022:4074-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SUSE OpenStack Cloud Crowbar 9 | python-Twisted | 15.2.1-9.23.1 | SUSE-SU-2022:4074-1 |
| SUSE OpenStack Cloud Crowbar 8 | python-Twisted | 15.2.1-9.23.1 | SUSE-SU-2022:4074-1 |
| SUSE OpenStack Cloud 9 | python-Twisted | 15.2.1-9.23.1 | SUSE-SU-2022:4074-1 |
| SUSE OpenStack Cloud 8 | python-Twisted | 15.2.1-9.23.1 | SUSE-SU-2022:4074-1 |
| SUSE HPE Helion OpenStack 8 | python-Twisted | 15.2.1-9.23.1 | SUSE-SU-2022:4074-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | python-Twisted | 22.10.0-1.1 | openSUSE-SU-2024:12474-1 |
| openSUSE Leap 15.4 | python-Twisted | 19.10.0-150200.3.18.1 | SUSE-SU-2022:4057-1, SUSE-SU-2022:4000-1 |
| openSUSE Leap 15.3 | python-Twisted | 19.10.0-150200.3.18.1 | SUSE-SU-2022:4057-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | python3-twisted +1 | 22.4.0-125.amzn2023.0.2 | ALAS2023-2023-130 |
| Amazon Linux 2 | python-twisted-web | 12.1.0-8.amzn2.0.1 | ALAS2-2023-2008 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 2 (CBL-Mariner) | python-twisted | 22.10.0-2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| PyPI | twisted | >= 0.9.4, < 22.10.0rc1 | 22.10.0rc1 | GHSA-vg46-2rrj-3647 |
Advisories 10
- WID-SEC-2023-2031 Xerox FreeFlow Print Server: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 11, 2026
- USN-6575-1 twisted vulnerabilities Ubuntu Security Notices (USN) · Apr 27, 2026
- DLA-3970-1 twisted - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3212-1 twisted - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2022:4000-1 Security update for python-Twisted SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4074-1 Security update for python-Twisted SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:12474-1 python-Twisted-doc-22.10.0-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2022:4057-1 Security update for python-Twisted SUSE / openSUSE Security Updates · Feb 4, 2026
- ALAS2-2023-2008 Moderate: python-twisted-web security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 4, 2023
- ALAS2023-2023-130 Moderate: python-twisted security update (Amazon Linux 2023) Amazon Linux Security Center (ALAS) · Mar 14, 2023
References
- https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647
- https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40b
- https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4
- [debian-lts-announce] 20221128 [SECURITY] [DLA 3212-1] twisted security update mailing-list
- GLSA-202301-02 vendor-advisory