CVE-2020-10108: Input Validation
In Twisted Web before 20.3.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
Other sources
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Twistedto a version that resolves this vulnerability.Fixed in 20.3.0 - Upgrade
Upgrade
debian/twistedto a version that resolves this vulnerability.Fixed in 20.3.0-7+deb11u1Fixed in 20.3.0-7+deb11u2Fixed in 22.4.0-4+deb12u1Fixed in 24.11.0-1Fixed in 25.5.0-5 - Upgrade
Upgrade
alpine/py3-twistedto a version that resolves this vulnerability.Fixed in 20.3.0-r0 - Upgrade
Upgrade
Twisted Webto a version that resolves this vulnerability.Fixed in 20.3.0
Event History
Frequently Asked Questions
What is CVE-2020-10108?
CVE-2020-10108 is an HTTP request splitting vulnerability in Twisted Web before version 20.3.0.
What is the severity of CVE-2020-10108?
CVE-2020-10108 has a severity rating of 9.8, which is considered critical.
How does CVE-2020-10108 affect Twisted?
CVE-2020-10108 affects Twisted Web versions up to 19.10.0.
How can I fix CVE-2020-10108?
To fix CVE-2020-10108, you should update Twisted Web to version 20.3.0 or later.
Where can I find more information about CVE-2020-10108?
You can find more information about CVE-2020-10108 at the Bishop Fox advisories page and the Fedora Project mailing list.