In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
Configuration 5 (hide)
|
History
25 Nov 2024, 18:12
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Twisted
Twisted twisted |
|
| CPE | cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:* |
21 Nov 2024, 04:54
| Type | Values Removed | Values Added |
|---|---|---|
| References | () https://know.bishopfox.com/advisories - Exploit, Third Party Advisory | |
| References | () https://know.bishopfox.com/advisories/twisted-version-19.10.0 - Release Notes, Third Party Advisory | |
| References | () https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html - Mailing List, Third Party Advisory | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/ - | |
| References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/ - | |
| References | () https://security.gentoo.org/glsa/202007-24 - Third Party Advisory | |
| References | () https://usn.ubuntu.com/4308-1/ - Third Party Advisory | |
| References | () https://usn.ubuntu.com/4308-2/ - Third Party Advisory | |
| References | () https://www.oracle.com/security-alerts/cpuoct2020.html - Patch, Third Party Advisory |
01 Apr 2022, 14:06
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-444 | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/ - Mailing List, Third Party Advisory | |
| References | (UBUNTU) https://usn.ubuntu.com/4308-1/ - Third Party Advisory | |
| References | (MLIST) https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html - Mailing List, Third Party Advisory | |
| References | (GENTOO) https://security.gentoo.org/glsa/202007-24 - Third Party Advisory | |
| References | (MISC) https://www.oracle.com/security-alerts/cpuoct2020.html - Patch, Third Party Advisory | |
| References | (FEDORA) https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/ - Mailing List, Third Party Advisory | |
| References | (UBUNTU) https://usn.ubuntu.com/4308-2/ - Third Party Advisory | |
| CPE | cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:* cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* cpe:2.3:a:oracle:zfs_storage_appliance_kit:8.8:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:oracle:solaris:11:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* cpe:2.3:o:oracle:solaris:10:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* |
19 Feb 2022, 19:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2020-03-12 13:15
Updated : 2024-11-25 18:12
NVD link : CVE-2020-10108
Mitre link : CVE-2020-10108
CVE.ORG link : CVE-2020-10108
JSON object : View
Products Affected
canonical
- ubuntu_linux
oracle
- zfs_storage_appliance_kit
- solaris
fedoraproject
- fedora
debian
- debian_linux
twisted
- twisted
CWE
CWE-444
Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')