Bug 2073114 (CVE-2022-24801)

Summary:	CVE-2022-24801 python-twisted: possible http request smuggling
Product:	[Other] Security Response	Reporter:	Marian Rehak <mrehak>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	high	Docs Contact:
Priority:	high
Version:	unspecified	CC:	amctagga, aoconnor, bbuckingham, bcourt, bniver, btotty, cstratak, eclipseo, eglynn, ehelms, flucifre, gmeno, jjoyce, jschluet, jsherril, lhh, lmadsen, lzap, mbenjamin, mburns, mgarciac, mhackett, mhroncok, mhulan, mmccune, mrunge, myarboro, nmoumoul, orabin, pcreech, python-maint, python-sig, rchan, rhos-maint, slinaber, sostapov, spower, tvignaud, vereddy
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	twisted 22.4.0	Doc Type:	If docs needed, set a value
Doc Text:	A flaw was found in python-twisted. This vulnerability occurs due to the parsing of illegal constructs in the twisted.web.http module. The illegal constructs include '+/-' in the Content-Length header, '\n and \t' etc. Non-conformant parsing leads to a desync if requests pass through multiple HTTP parsers. This flaw allows a remote attacker to perform an HTTP request smuggling attack.	Story Points:	---
Clone Of:		Environment:
Last Closed:	2022-04-29 17:16:05 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2073115, 2073116, 2073271, 2073299, 2073300, 2073301, 2074655, 2074656, 2074657, 2074658, 2075656
Bug Blocks:	2073118

Description Marian Rehak 2022-04-07 16:20:23 UTC

Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy.

Reference:

https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq

Comment 1 Marian Rehak 2022-04-07 16:20:48 UTC

Created python-twisted tracking bugs for this issue:

Affects: epel-8 [bug 2073116]
Affects: fedora-all [bug 2073115]

Comment 2 Sandipan Roy 2022-04-08 05:51:29 UTC

Red Hat Enterprise Linux 6 was affected but Out of Support Cycle because python-twisted was not listed in Red Hat Enterprise Linux 6 ELS Inclusion List.
Ref: https://access.redhat.com/articles/4997301

Comment 3 Sandipan Roy 2022-04-08 05:52:35 UTC

Advisory: https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq
Upstream Patch: https://github.com/twisted/twisted/commit/592217e951363d60e9cd99c5bbfd23d4615043ac

Comment 8 errata-xmlrpc 2022-04-28 15:44:42 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2022:1645 https://access.redhat.com/errata/RHSA-2022:1645

Comment 9 errata-xmlrpc 2022-04-28 15:45:01 UTC

This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2022:1646 https://access.redhat.com/errata/RHSA-2022:1646

Comment 10 Product Security DevOps Team 2022-04-29 17:16:01 UTC

This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-24801

Comment 13 errata-xmlrpc 2022-06-07 11:53:26 UTC

This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:4930 https://access.redhat.com/errata/RHSA-2022:4930