USN-4308-1: Twisted vulnerabilities
it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote attacker could use this issue to inject invalid characters and possibly perform header injection attacks. (CVE-2019-12387) It was discovered that Twisted incorrectly verified XMPP TLS certificates. A remote attacker could possibly use this issue to perform a machine-in-the-middle attack and obtain sensitive information. (CVE-2019-12855) It was discovered that Twisted incorrectly handled HTTP/2 connections. A remote attacker could possibly use this issue to cause Twisted to hang or consume resources, leading to a denial of service. This issue only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-9512, CVE-2019-9514, CVE-2019-9515) Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled certain content-length headers. A remote attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2020-10108, CVE-2020-10109)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/python-twistedto a version that resolves this vulnerability.Fixed in 18.9.0-3ubuntu1.1 - Upgrade
Upgrade
ubuntu/python-twisted-binto a version that resolves this vulnerability.Fixed in 18.9.0-3ubuntu1.1 - Upgrade
Upgrade
ubuntu/python-twisted-webto a version that resolves this vulnerability.Fixed in 18.9.0-3ubuntu1.1 - Upgrade
Upgrade
ubuntu/python3-twistedto a version that resolves this vulnerability.Fixed in 18.9.0-3ubuntu1.1 - Upgrade
Upgrade
ubuntu/python3-twisted-binto a version that resolves this vulnerability.Fixed in 18.9.0-3ubuntu1.1 - Upgrade
Upgrade
ubuntu/python-twistedto a version that resolves this vulnerability.Fixed in 17.9.0-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/python-twisted-binto a version that resolves this vulnerability.Fixed in 17.9.0-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/python-twisted-webto a version that resolves this vulnerability.Fixed in 17.9.0-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/python3-twistedto a version that resolves this vulnerability.Fixed in 17.9.0-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/python3-twisted-binto a version that resolves this vulnerability.Fixed in 17.9.0-2ubuntu0.1 - Upgrade
Upgrade
ubuntu/python-twistedto a version that resolves this vulnerability.Fixed in 16.0.0-1ubuntu0.4 - Upgrade
Upgrade
ubuntu/python-twisted-binto a version that resolves this vulnerability.Fixed in 16.0.0-1ubuntu0.4 - Upgrade
Upgrade
ubuntu/python-twisted-webto a version that resolves this vulnerability.Fixed in 16.0.0-1ubuntu0.4 - Upgrade
Upgrade
ubuntu/python3-twistedto a version that resolves this vulnerability.Fixed in 16.0.0-1ubuntu0.4
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
What is the vulnerability ID for the Twisted vulnerabilities?
The vulnerability ID for the Twisted vulnerabilities is CVE-2019-12387.
How can a remote attacker exploit the Twisted vulnerabilities?
A remote attacker could exploit the Twisted vulnerabilities by injecting invalid characters and possibly performing header injection attacks.
What software packages are affected by the Twisted vulnerabilities?
The Twisted vulnerabilities affect the following software packages: python-twisted, python-twisted-bin, python-twisted-web, python3-twisted, python3-twisted-bin.
Are the Twisted vulnerabilities only present in Ubuntu 19.10?
No, the Twisted vulnerabilities are present in multiple versions of Ubuntu, including 19.10, 18.04, and 16.04.
Where can I find more information about the Twisted vulnerabilities?
You can find more information about the Twisted vulnerabilities on the Ubuntu security website.