Bug 2073114 (CVE-2022-24801) - CVE-2022-24801 python-twisted: possible http request smuggling
Summary: CVE-2022-24801 python-twisted: possible http request smuggling
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2022-24801
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2073115 2073116 2073271 2073299 2073300 2073301 2074655 2074656 2074657 2074658 2075656
Blocks: 2073118
TreeView+ depends on / blocked
 
Reported: 2022-04-07 16:20 UTC by Marian Rehak
Modified: 2022-06-07 11:53 UTC (History)
39 users (show)

Fixed In Version: twisted 22.4.0
Doc Type: If docs needed, set a value
Doc Text:
A flaw was found in python-twisted. This vulnerability occurs due to the parsing of illegal constructs in the twisted.web.http module. The illegal constructs include '+/-' in the Content-Length header, '\n and \t' etc. Non-conformant parsing leads to a desync if requests pass through multiple HTTP parsers. This flaw allows a remote attacker to perform an HTTP request smuggling attack.
Clone Of:
Environment:
Last Closed: 2022-04-29 17:16:05 UTC
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2022:1645 0 None None None 2022-04-28 15:44:46 UTC
Red Hat Product Errata RHSA-2022:1646 0 None None None 2022-04-28 15:45:04 UTC
Red Hat Product Errata RHSA-2022:4930 0 None None None 2022-06-07 11:53:29 UTC

Description Marian Rehak 2022-04-07 16:20:23 UTC 
Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web's HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy.

Reference:

https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq
Comment 1 Marian Rehak 2022-04-07 16:20:48 UTC 
Created python-twisted tracking bugs for this issue:

Affects: epel-8 [bug 2073116]
Affects: fedora-all [bug 2073115]
Comment 2 Sandipan Roy 2022-04-08 05:51:29 UTC 
Red Hat Enterprise Linux 6 was affected but Out of Support Cycle because python-twisted was not listed in Red Hat Enterprise Linux 6 ELS Inclusion List.
Ref: https://access.redhat.com/articles/4997301
Comment 3 Sandipan Roy 2022-04-08 05:52:35 UTC 
Advisory: https://github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq
Upstream Patch: https://github.com/twisted/twisted/commit/592217e951363d60e9cd99c5bbfd23d4615043ac
Comment 8 errata-xmlrpc 2022-04-28 15:44:42 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.2

Via RHSA-2022:1645 https://access.redhat.com/errata/RHSA-2022:1645
Comment 9 errata-xmlrpc 2022-04-28 15:45:01 UTC 
This issue has been addressed in the following products:

  Red Hat OpenStack Platform 16.1

Via RHSA-2022:1646 https://access.redhat.com/errata/RHSA-2022:1646
Comment 10 Product Security DevOps Team 2022-04-29 17:16:01 UTC 
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s):

https://access.redhat.com/security/cve/cve-2022-24801
Comment 13 errata-xmlrpc 2022-06-07 11:53:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 7

Via RHSA-2022:4930 https://access.redhat.com/errata/RHSA-2022:4930
Note You need to log in before you can comment on or make changes to this bug.