Patchwire CVEs, their patch status, and feeds to follow them

CVE-2020-10108

Fixed in a distro release EPSS 4%

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.

Published 2020-03-12 · CVE record · OSV

Products: twisted, fedoraproject fedora, debian_linux, canonical ubuntu_linux, oracle zfs_storage_appliance_kit, oracle solaris

Fixed upstream

EcosystemPackageFixed in
PyPItwisted20.3.0
PyPItwisted20.3.0rc1

Distro releases

ReleasePackageFixed in
Amazon Linux 2python-twisted-web12.1.0-7.amzn2
Debian 12twisted18.9.0-7
Debian 13twisted18.9.0-7
Debian 14twisted18.9.0-7
Debian 8twisted14.0.2-3+deb8u1
Debian 9twisted16.6.0-2+deb9u1
Red Hat Enterprise Linux 6python-twisted-web0:8.2.0-6.el6_10
Red Hat Enterprise Linux 7python-twisted-web0:12.1.0-7.el7_8
SUSE HPE Helion OpenStack 8python-Twisted15.2.1-9.20.1
SUSE HPE Helion OpenStack 8python-Twisted15.2.1-9.23.1
SUSE Linux Enterprise Module for Web and Scripting 12python-Twisted15.2.1-9.23.1
SUSE Linux Enterprise Module for Web and Scripting 12python-Twisted15.2.1-9.20.1
SUSE OpenStack Cloud 8python-Twisted15.2.1-9.20.1
SUSE OpenStack Cloud 8python-Twisted15.2.1-9.23.1
SUSE OpenStack Cloud 9python-Twisted15.2.1-9.20.1
SUSE OpenStack Cloud 9python-Twisted15.2.1-9.23.1
SUSE OpenStack Cloud Crowbar 8python-Twisted15.2.1-9.23.1
SUSE OpenStack Cloud Crowbar 8python-Twisted15.2.1-9.20.1
SUSE OpenStack Cloud Crowbar 9python-Twisted15.2.1-9.20.1
SUSE OpenStack Cloud Crowbar 9python-Twisted15.2.1-9.23.1
Ubuntu 16.04 LTStwisted16.0.0-1ubuntu0.4
Ubuntu 18.04 LTStwisted17.9.0-2ubuntu0.1
Ubuntu Pro 14.04 LTStwisted13.2.0-1ubuntu1.2+esm1
openSUSE Tumbleweedmatrix-synapse1.43.0-1.1