Bug 1166458 - (CVE-2020-10109) VUL-0: CVE-2020-10109: python-Twisted: requests with a Content-Length header and a Transfer-Encoding header honored the first header
(CVE-2020-10109)
VUL-0: CVE-2020-10109: python-Twisted: requests with a Content-Length header ...
Status: RESOLVED FIXED
Classification: Novell Products
Product: SUSE Security Incidents
Classification: Novell Products
Component: Incidents
unspecified
Other Other
: P3 - Medium : Normal
: ---
Assigned To: Security Team bot
Security Team bot
https://smash.suse.de/issue/254656/
CVSSv3.1:SUSE:CVE-2020-10109:7.5:(AV...
:
Depends on:
Blocks:
  Show dependency treegraph
 
Reported: 2020-03-12 09:16 UTC by Wolfgang Frisch
Modified: 2022-08-16 16:20 UTC (History)
4 users (show)

See Also:
Found By: Security Response Team
Services Priority:
Business Priority:
Blocker: ---
Marketing QA Status: ---
IT Deployment: ---


Attachments
twisted-web-helloworld.py (499 bytes, text/plain)
2020-03-12 10:39 UTC, Wolfgang Frisch
Details

Note You need to log in before you can comment on or make changes to this bug.
Description Wolfgang Frisch 2020-03-12 09:16:27 UTC
CVE-2020-10109

An HTTP request smuggling issue was found in python-Twisted. Requests with a Content-Length header and a Transfer-Encoding header honored the first header.

References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-10109
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10109
http://people.canonical.com/~ubuntu-security/cve/2020/CVE-2020-10109.html
Comment 1 Wolfgang Frisch 2020-03-12 09:26:12 UTC
SUSE:SLE-12:Update   python-Twisted   Affected
SUSE:SLE-15:Update   python-Twisted   Affected
Comment 2 Wolfgang Frisch 2020-03-12 10:39:36 UTC
Created attachment 832627 [details]
twisted-web-helloworld.py

QA REPRODUCER:

# python3 twisted-web-helloworld.py
# printf "GET / HTTP/1.1\r\nTransfer-Encoding: chunked\r\nContent-Length: 0\r\nUser-Agent: nc/0.0.1\r\nHost: 127.0.0.1\r\nAccept: */*\r\n\r\n" | nc 127.0.0.1 8080

Result GOOD:
> HTTP/1.1 400 Bad Request

Result FAIL:
> HTTP/1.1 200 OK
> [...]
Comment 3 Matej Cepl 2022-08-02 08:55:11 UTC
When I have already CVE-2020-10108, I don’t know why I shouldn’t have this one as well.
Comment 4 Matej Cepl 2022-08-02 08:57:47 UTC
In rh#1813447 it is suggested that https://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281 is the fix and it claims that the first vulnerable release is twisted-9.0.0.
Comment 5 Gianluca Gabrielli 2022-08-02 10:55:14 UTC
Thanks Matej for having spotted this one as well, could you please submit the suggested patch?

I see the following supported packages:
 - SUSE:SLE-12:Update/python-Twisted       15.2.1
 - SUSE:SLE-15-SP2:Update/python-Twisted   19.10.0
 - SUSE:SLE-15-SP4:Update/python-Twisted   22.2.0
 - openSUSE:Factory/python-Twisted         22.4.0

The latest two should already contain the fix.
Comment 6 Matej Cepl 2022-08-02 12:01:59 UTC
(In reply to Gianluca Gabrielli from comment #5)
> Thanks Matej for having spotted this one as well, could you please submit
> the suggested patch?
> 
> I see the following supported packages:
>  - SUSE:SLE-12:Update/python-Twisted       15.2.1
>  - SUSE:SLE-15-SP2:Update/python-Twisted   19.10.0
>  - SUSE:SLE-15-SP4:Update/python-Twisted   22.2.0
>  - openSUSE:Factory/python-Twisted         22.4.0
> 
> The latest two should already contain the fix.

The same what I said in bug CVE-2020-10108, and according to the CVE report, this bug has been fixed in 19.10.0, which is exactly what we have in SLE-15-SP2 and in SLE-15-SP4 we have even 22.2.0.
Comment 8 Gianluca Gabrielli 2022-08-02 13:54:23 UTC
in SUSE:SLE-15-SP2:Update/python-Twisted we actually backported part of the patch mentioned in comment4 via `CVE-2022-24801-http-1.1-leniency.patch`.

AFAICS from upstream, that comment was introduced in 20.3.0. That said, the submission for SLE-12 was probably the only one needed. Thanks
Comment 9 Gianluca Gabrielli 2022-08-02 13:58:58 UTC
Because we fixed CVE-2020-10109 in SUSE:SLE-15-SP2:Update/python-Twisted via `CVE-2022-24801-http-1.1-leniency.patch` it misses references in its changes file (CVE-2020-10109, bsc#1166458). Can you please add them during your next submission to that package?
Comment 11 Gianluca Gabrielli 2022-08-03 09:12:11 UTC
Closing, thanks
Comment 12 Swamp Workflow Management 2022-08-16 13:16:38 UTC
SUSE-SU-2022:2811-1: An update that fixes two vulnerabilities is now available.

Category: security (important)
Bug References: 1166457,1166458
CVE References: CVE-2020-10108,CVE-2020-10109
JIRA References: 
Sources used:
SUSE OpenStack Cloud Crowbar 9 (src):    python-Twisted-15.2.1-9.20.1
SUSE OpenStack Cloud Crowbar 8 (src):    python-Twisted-15.2.1-9.20.1
SUSE OpenStack Cloud 9 (src):    python-Twisted-15.2.1-9.20.1
SUSE OpenStack Cloud 8 (src):    python-Twisted-15.2.1-9.20.1
SUSE Linux Enterprise Module for Web Scripting 12 (src):    python-Twisted-15.2.1-9.20.1
HPE Helion Openstack 8 (src):    python-Twisted-15.2.1-9.20.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.
Comment 13 Swamp Workflow Management 2022-08-16 16:20:54 UTC
SUSE-SU-2022:2822-1: An update that fixes one vulnerability is now available.

Category: security (important)
Bug References: 1166458
CVE References: CVE-2020-10109
JIRA References: 
Sources used:
openSUSE Leap 15.4 (src):    python-Twisted-19.10.0-150200.3.15.1
openSUSE Leap 15.3 (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Manager Server 4.1 (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Manager Retail Branch Server 4.1 (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Manager Proxy 4.1 (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Linux Enterprise Server for SAP 15-SP2 (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Linux Enterprise Server 15-SP2-LTSS (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Linux Enterprise Server 15-SP2-BCL (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Linux Enterprise Module for Server Applications 15-SP3 (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Linux Enterprise Module for Packagehub Subpackages 15-SP3 (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Linux Enterprise High Performance Computing 15-SP2-LTSS (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Linux Enterprise High Performance Computing 15-SP2-ESPOS (src):    python-Twisted-19.10.0-150200.3.15.1
SUSE Enterprise Storage 7 (src):    python-Twisted-19.10.0-150200.3.15.1

NOTE: This line indicates an update has been released for the listed product(s). At times this might be only a partial fix. If you have questions please reach out to maintenance coordination.