Bugzilla – Bug 1166458
VUL-0: CVE-2020-10109: python-Twisted: requests with a Content-Length header and a Transfer-Encoding header honored the first header
Last modified: 2022-08-16 16:20:54 UTC
CVE-2020-10109 An HTTP request smuggling issue was found in python-Twisted. Requests with a Content-Length header and a Transfer-Encoding header honored the first header. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10109 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10109 http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-10109.html
SUSE:SLE-12:Update python-Twisted Affected SUSE:SLE-15:Update python-Twisted Affected
Created attachment 832627 [details] twisted-web-helloworld.py QA REPRODUCER: # python3 twisted-web-helloworld.py # printf "GET / HTTP/1.1\r\nTransfer-Encoding: chunked\r\nContent-Length: 0\r\nUser-Agent: nc/0.0.1\r\nHost: 127.0.0.1\r\nAccept: */*\r\n\r\n" | nc 127.0.0.1 8080 Result GOOD: > HTTP/1.1 400 Bad Request Result FAIL: > HTTP/1.1 200 OK > [...]
When I have already CVE-2020-10108, I don’t know why I shouldn’t have this one as well.
In rh#1813447 it is suggested that https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281 is the fix and it claims that the first vulnerable release is twisted-9.0.0.
Thanks Matej for having spotted this one as well, could you please submit the suggested patch? I see the following supported packages: - SUSE:SLE-12:Update/python-Twisted 15.2.1 - SUSE:SLE-15-SP2:Update/python-Twisted 19.10.0 - SUSE:SLE-15-SP4:Update/python-Twisted 22.2.0 - openSUSE:Factory/python-Twisted 22.4.0 The latest two should already contain the fix.
(In reply to Gianluca Gabrielli from comment #5) > Thanks Matej for having spotted this one as well, could you please submit > the suggested patch? > > I see the following supported packages: > - SUSE:SLE-12:Update/python-Twisted 15.2.1 > - SUSE:SLE-15-SP2:Update/python-Twisted 19.10.0 > - SUSE:SLE-15-SP4:Update/python-Twisted 22.2.0 > - openSUSE:Factory/python-Twisted 22.4.0 > > The latest two should already contain the fix. The same what I said in bug CVE-2020-10108, and according to the CVE report, this bug has been fixed in 19.10.0, which is exactly what we have in SLE-15-SP2 and in SLE-15-SP4 we have even 22.2.0.
in SUSE:SLE-15-SP2:Update/python-Twisted we actually backported part of the patch mentioned in comment4 via `CVE-2022-24801-http-1.1-leniency.patch`. AFAICS from upstream, that comment was introduced in 20.3.0. That said, the submission for SLE-12 was probably the only one needed. Thanks
Because we fixed CVE-2020-10109 in SUSE:SLE-15-SP2:Update/python-Twisted via `CVE-2022-24801-http-1.1-leniency.patch` it misses references in its changes file (CVE-2020-10109, bsc#1166458). Can you please add them during your next submission to that package?
Closing, thanks
SUSE-SU-2022:2811-1: An update that fixes two vulnerabilities is now available. Category: security (important) Bug References: 1166457,1166458 CVE References: CVE-2020-10108,CVE-2020-10109 JIRA References: Sources used: SUSE OpenStack Cloud Crowbar 9 (src): python-Twisted-15.2.1-9.20.1 SUSE OpenStack Cloud Crowbar 8 (src): python-Twisted-15.2.1-9.20.1 SUSE OpenStack Cloud 9 (src): python-Twisted-15.2.1-9.20.1 SUSE OpenStack Cloud 8 (src): python-Twisted-15.2.1-9.20.1 SUSE Linux Enterprise Module for Web Scripting 12 (src): python-Twisted-15.2.1-9.20.1 HPE Helion Openstack 8 (src): python-Twisted-15.2.1-9.20.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
SUSE-SU-2022:2822-1: An update that fixes one vulnerability is now available. Category: security (important) Bug References: 1166458 CVE References: CVE-2020-10109 JIRA References: Sources used: openSUSE Leap 15.4 (src): python-Twisted-19.10.0-150200.3.15.1 openSUSE Leap 15.3 (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Manager Server 4.1 (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Manager Retail Branch Server 4.1 (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Manager Proxy 4.1 (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Linux Enterprise Server for SAP 15-SP2 (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Linux Enterprise Server 15-SP2-LTSS (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Linux Enterprise Server 15-SP2-BCL (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Linux Enterprise Module for Server Applications 15-SP3 (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src): python-Twisted-19.10.0-150200.3.15.1 SUSE Enterprise Storage 7 (src): python-Twisted-19.10.0-150200.3.15.1 NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.