CVE-2023-46137: twisted.web has disordered HTTP pipeline response
Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
pip/twistedto a version that resolves this vulnerability.Fixed in 23.10.0rc1 - Upgrade
Upgrade
ubuntu/twistedto a version that resolves this vulnerability.Fixed in 18.9.0-11ubuntu0.20.04.3 - Upgrade
Upgrade
ubuntu/twistedto a version that resolves this vulnerability.Fixed in 22.1.0-2ubuntu2.4 - Upgrade
Upgrade
ubuntu/twistedto a version that resolves this vulnerability.Fixed in 22.4.0-4ubuntu0.23.04.1 - Upgrade
Upgrade
ubuntu/twistedto a version that resolves this vulnerability.Fixed in 22.4.0-4ubuntu0.23.10.1 - Upgrade
Upgrade
redhat/twistedto a version that resolves this vulnerability.Fixed in 23.10.0 - Upgrade
Upgrade
debian/twistedto a version that resolves this vulnerability.Fixed in 22.4.0-4+deb12u1Fixed in 24.11.0-1Fixed in 26.10.0-1 - Upgrade
Upgrade
twisted/twistedto a version that resolves this vulnerability.Fixed in 23.10.0rc1
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-46137.
What is the severity of CVE-2023-46137?
The severity of CVE-2023-46137 is medium with a CVSS score of 5.3.
What software is affected by CVE-2023-46137?
The affected software is the twisted package with version up to and excluding 23.10.0rc1.
How does CVE-2023-46137 manifest?
CVE-2023-46137 manifests when multiple HTTP requests are sent in one TCP packet, causing twisted.web to process the requests asynchronously without guaranteeing the response order.
Are there any references for CVE-2023-46137?
Yes, you can find more information about CVE-2023-46137 in the following references: [GitHub Advisory](https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm), [GitHub Advisories](https://github.com/advisories/GHSA-xc8x-vp79-p3wm).