CVE-2020-10109: Critical severity Twisted Twisted vulnerability
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.
Other sources
In Twisted Web through 20.3.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.
— GitHub
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2020-10109?
CVE-2020-10109 is an HTTP request splitting vulnerability in Twisted Web through 20.3.0.
How severe is CVE-2020-10109?
CVE-2020-10109 has a severity score of 9.8, which is considered critical.
Which versions of Twisted Web are affected by CVE-2020-10109?
Twisted Web versions up to and including 20.3.0 are affected by CVE-2020-10109.
How can I fix CVE-2020-10109?
To fix CVE-2020-10109, update Twisted Web to version 20.3.0 or higher.
Where can I find more information about CVE-2020-10109?
You can find more information about CVE-2020-10109 at the following URLs: https://know.bishopfox.com/advisories and https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/