GHSA-6cc5-2vg4-cc7m

ghsaUSosv

Twisted CRLF Injection

view advisory published 2019-06-10Licence: CC-BY-4.0

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2019-12387US	medium6.1	2.52% (85th)	—	2019-06-10
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.

references

External citations — patches, advisories, analysis.

http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.htmlWEB
http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.htmlWEB
https://github.com/advisories/GHSA-6cc5-2vg4-cc7mADVISORY
https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2019-128.yamlWEB
https://github.com/twisted/twistedPACKAGE
https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2WEB
https://labs.twistedmatrix.com/2019/06/twisted-1921-released.htmlWEB
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7NWEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan