CVE-2020-10109: Critical severity Twisted Twisted vulnerability
In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.
Other sources
In Twisted Web through 20.3.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/Twistedto a version that resolves this vulnerability.Fixed in 20.3.0 - Upgrade
Upgrade
debian/twistedto a version that resolves this vulnerability.Fixed in 20.3.0-7+deb11u1Fixed in 20.3.0-7+deb11u2Fixed in 22.4.0-4+deb12u1Fixed in 24.11.0-1Fixed in 25.5.0-5 - Upgrade
Upgrade
alpine/py3-twistedto a version that resolves this vulnerability.Fixed in 20.3.0-r0
Event History
Frequently Asked Questions
What is CVE-2020-10109?
CVE-2020-10109 is an HTTP request splitting vulnerability in Twisted Web through 20.3.0.
How severe is CVE-2020-10109?
CVE-2020-10109 has a severity score of 9.8, which is considered critical.
Which versions of Twisted Web are affected by CVE-2020-10109?
Twisted Web versions up to and including 20.3.0 are affected by CVE-2020-10109.
How can I fix CVE-2020-10109?
To fix CVE-2020-10109, update Twisted Web to version 20.3.0 or higher.
Where can I find more information about CVE-2020-10109?
You can find more information about CVE-2020-10109 at the following URLs: https://know.bishopfox.com/advisories and https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/