CVE-2022-39348
Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.
Does this matter?
Lower severity and a low EPSS score (1.24%). Track it; it rarely justifies an emergency change on its own.
Description
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
- CVSS 3.1
- 5.4 MEDIUMCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
- EPSS
- 1.24% probability · 68th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-79, CWE-80
- Affected
- twisted/twisted · debian/debian linux
- Source
- security-advisories@github.com
References
- https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40bPatch
- https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4Patch
- https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647Exploit, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00038.htmlMailing List, Third Party Advisory
- https://security.gentoo.org/glsa/202301-02Third Party Advisory
- https://github.com/twisted/twisted/commit/f2f5e81c03f14e253e85fe457e646130780db40bPatch
- https://github.com/twisted/twisted/commit/f49041bb67792506d85aeda9cf6157e92f8048f4Patch
- https://github.com/twisted/twisted/security/advisories/GHSA-vg46-2rrj-3647Exploit, Patch, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/11/msg00038.htmlMailing List, Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2024/11/msg00028.html
- https://security.gentoo.org/glsa/202301-02Third Party Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.