CVE-2023-46137: twisted.web has disordered HTTP pipeline response
Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-46137.
What is the severity of CVE-2023-46137?
The severity of CVE-2023-46137 is medium with a CVSS score of 5.3.
What software is affected by CVE-2023-46137?
The affected software is the twisted package with version up to and excluding 23.10.0rc1.
How does CVE-2023-46137 manifest?
CVE-2023-46137 manifests when multiple HTTP requests are sent in one TCP packet, causing twisted.web to process the requests asynchronously without guaranteeing the response order.
Are there any references for CVE-2023-46137?
Yes, you can find more information about CVE-2023-46137 in the following references: [GitHub Advisory](https://github.com/twisted/twisted/security/advisories/GHSA-xc8x-vp79-p3wm), [GitHub Advisories](https://github.com/advisories/GHSA-xc8x-vp79-p3wm).