Bug 2060960 (CVE-2022-21716)

Summary:	CVE-2022-21716 python-twisted: SSH client and server denial of service during SSH handshake
Product:	[Other] Security Response	Reporter:	Mauro Matteo Cascella <mcascell>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	bbuckingham, bcoca, bcourt, btotty, chousekn, cmeyers, davidn, dbecker, eclipseo, ehelms, gblomqui, jcammara, jhardy, jjoyce, jobarker, jschluet, jsherril, lhh, lmadsen, lpeer, lzap, mabashia, mburns, mgarciac, mhroncok, mhulan, mmccune, mrunge, myarboro, nmoumoul, notting, orabin, osapryki, pcreech, python-maint, python-sig, rchan, relrod, rhos-maint, rpetrell, sclewis, sdoran, slinaber, smcdonal, tkuratom, tvignaud
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	python-twisted 22.2.0	Doc Type:	If docs needed, set a value
Doc Text:	An uncontrolled resource consumption flaw was found in python-twisted in the dataReceived() function. This flaw allows an unauthenticated, remote attacker to send a simple command to use all available memory and crash the server.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-03-24 14:02:48 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2060972, 2060973, 2061094, 2061095, 2061096, 2061097, 2061456, 2061457, 2062134, 2062135
Bug Blocks:	2060958

Description Mauro Matteo Cascella 2022-03-04 17:14:50 UTC

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, the Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier. A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service.

References:
https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx
https://github.com/twisted/twisted/releases/tag/twisted-22.2.0

Upstream commit:
https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9

Comment 1 Mauro Matteo Cascella 2022-03-04 18:19:10 UTC

Created python-twisted tracking bugs for this issue:

Affects: epel-all [bug 2060973]
Affects: fedora-all [bug 2060972]

Comment 4 Lon Hohberger 2022-03-08 21:11:01 UTC

Corrected upstream commit:

https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1

Comment 6 errata-xmlrpc 2022-03-23 22:29:24 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2022:0992 https://access.redhat.com/errata/RHSA-2022:0992

Comment 7 errata-xmlrpc 2022-03-24 11:04:17 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2022:0982 https://access.redhat.com/errata/RHSA-2022:0982

Comment 8 Product Security DevOps Team 2022-03-24 14:02:45 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-21716