CVE-2022-21712
Summary
| CVE | CVE-2022-21712 |
|---|
| State | PUBLIC |
|---|
| Assigner | [email protected] |
|---|
| Source Priority | CVE Program / NVD first with legacy fallback |
|---|
| Published | 2022-02-07 22:15:00 UTC |
|---|
| Updated | 2023-11-07 03:43:00 UTC |
|---|
| Description | twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds. |
|---|
NVD Known Affected Configurations (CPE 2.3)
References
| Reference | Source | Link | Tags |
|---|
| [SECURITY] Fedora 35 Update: python-twisted-22.4.0-1.fc35 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| Release Twisted 22.1.0 · twisted/twisted · GitHub |
MISC |
github.com |
|
| Cookie and Authorization headers are sent when following a cross-origin redirect with twisted.web.client · Advisory · twisted/twisted · GitHub |
CONFIRM |
github.com |
|
| [SECURITY] Fedora 35 Update: python-twisted-22.4.0-1.fc35 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| Twisted: Multiple Vulnerabilities (GLSA 202301-02) — Gentoo security |
GENTOO |
security.gentoo.org |
|
| Merge pull request from GHSA-92x2-jw7w-xvvx · twisted/twisted@af8fe78 · GitHub |
MISC |
github.com |
|
| [SECURITY] Fedora 36 Update: python-twisted-22.4.0-1.fc36 - package-announce - Fedora Mailing-Lists |
FEDORA |
lists.fedoraproject.org |
|
| [SECURITY] [DLA 2927-1] twisted security update |
MLIST |
lists.debian.org |
|
| [SECURITY] Fedora 36 Update: python-twisted-22.4.0-1.fc36 - package-announce - Fedora Mailing-Lists |
|
lists.fedoraproject.org |
|
| CVE Program record |
CVE.ORG |
www.cve.org |
canonical |
| NVD vulnerability detail |
NVD |
nvd.nist.gov |
canonical, analysis |
No vendor comments have been submitted for this CVE.
Legacy QID Mappings
- 179090 Debian Security Update for twisted (DLA 2927-1)
- 180844 Debian Security Update for twisted (CVE-2022-21712)
- 198719 Ubuntu Security Notification for Twisted Vulnerabilities (USN-5354-1)
- 240180 Red Hat Update for OpenStack Platform 16.1 (RHSA-2022:0982)
- 240181 Red Hat Update for OpenStack Platform 16.2 (RHSA-2022:0992)
- 282889 Fedora Security Update for python (FEDORA-2022-9a489fa494)
- 282890 Fedora Security Update for python (FEDORA-2022-71b66d4747)
- 296057 Oracle Solaris 11.4 Support Repository Update (SRU) 44.113.4 Missing (bulletinapr2022)
- 354290 Amazon Linux Security Advisory for python-twisted : ALAS2022-2022-231
- 354583 Amazon Linux Security Advisory for python-twisted : ALAS-2022-231
- 355118 Amazon Linux Security Advisory for python-twisted : ALAS2023-2023-056
- 502346 Alpine Linux Security Update for py3-twisted
- 710703 Gentoo Linux Twisted Multiple Vulnerabilities (GLSA 202301-02)
- 751725 SUSE Enterprise Linux Security Update for python-Twisted (SUSE-SU-2022:0499-1)
- 751748 OpenSUSE Security Update for python-Twisted (openSUSE-SU-2022:0499-1)
- 900689 Common Base Linux Mariner (CBL-Mariner) Security Update for python-twisted (8502)
- 900865 Common Base Linux Mariner (CBL-Mariner) Security Update for python-twisted (8505-1)
