USN-9000-1: Twisted vulnerability
It was discovered that Twisted's IMAP server mishandled wildcard patterns in mailbox list commands. An authenticated remote attacker could possibly use this issue to cause Twisted to use excessive resources, leading to a denial of service.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/python3-twistedto a version that resolves this vulnerability.Fixed in 26.4.0-4ubuntu0.1 - Upgrade
Upgrade
ubuntu/python3-twistedto a version that resolves this vulnerability.Fixed in 25.5.0-5ubuntu0.2 - Upgrade
Upgrade
ubuntu/python3-twistedto a version that resolves this vulnerability.Fixed in 24.3.0-1ubuntu0.3 - Upgrade
Upgrade
ubuntu/python3-twistedto a version that resolves this vulnerability.Fixed in 22.1.0-2ubuntu2.8
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be able to connect to the affected Twisted IMAP server and authenticate successfully. The reported impact is denial of service through excessive resource consumption.
Which deployments are exposed?
Deployments using Twisted's IMAP server are relevant. The provided information does not establish whether installations using Twisted only for other functionality are affected.
How can I determine whether my system needs the update?
Check whether the system has the Ubuntu python3-twisted package installed and is running a Twisted IMAP server. The advisory references updated Ubuntu source packages 26.4.0-4ubuntu0.1 and 25.5.0-5ubuntu0.2.