CVE-2020-10108: Input Validation
In Twisted Web before 20.3.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
Other sources
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
— Launchpad
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-10108?
CVE-2020-10108 is an HTTP request splitting vulnerability in Twisted Web before version 20.3.0.
What is the severity of CVE-2020-10108?
CVE-2020-10108 has a severity rating of 9.8, which is considered critical.
How does CVE-2020-10108 affect Twisted?
CVE-2020-10108 affects Twisted Web versions up to 19.10.0.
How can I fix CVE-2020-10108?
To fix CVE-2020-10108, you should update Twisted Web to version 20.3.0 or later.
Where can I find more information about CVE-2020-10108?
You can find more information about CVE-2020-10108 at the Bishop Fox advisories page and the Fedora Project mailing list.