CVE-2022-21712
Fixed in a distro release EPSS 1%CVSS 7.5
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.
Products: twisted
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | twisted | 22.1.0 |
| PyPI | twisted | af8fe78542a6f2bf2235ccee8158d9c88d31e8e2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | python3-twisted | 22.4.0-124.amzn2023.0.2 |
| Amazon Linux 2023 | python3-twisted+tls | 22.4.0-124.amzn2023.0.2 |
| Arch Linux | python-twisted | no fix |
| Debian 12 | twisted | 22.1.0-1 |
| Debian 13 | twisted | 22.1.0-1 |
| Debian 14 | twisted | 22.1.0-1 |
| Debian 9 | twisted | 16.6.0-2+deb9u1 |
| Red Hat openstack 16.1 | python-twisted | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.1 | python-twisted-debugsource | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.1 | python3-twisted | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.1 | python3-twisted-debuginfo | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.2 | python-twisted | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.2 | python-twisted-debugsource | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.2 | python3-twisted | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.2 | python3-twisted-debuginfo | 0:16.4.1-19.el8ost |
| SUSE Enterprise Storage 7 | python-Twisted | 19.10.0-3.6.1 |
| SUSE HPE Helion OpenStack 8 | python-Twisted | 15.2.1-9.11.1 |
| SUSE HPE Helion OpenStack 8 | python-Twisted | 15.2.1-9.23.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | python-Twisted | 19.10.0-3.6.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | python-Twisted | 19.10.0-3.6.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP3 | python-Twisted | 19.10.0-3.6.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP3 | python-Twisted | 19.10.0-3.6.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | python-Twisted | 15.2.1-9.23.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | python-Twisted | 15.2.1-9.11.1 |
| SUSE Linux Enterprise Real Time 15 SP2 | python-Twisted | 19.10.0-3.6.1 |
| SUSE Linux Enterprise Server 15 SP2-BCL | python-Twisted | 19.10.0-3.6.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | python-Twisted | 19.10.0-3.6.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | python-Twisted | 19.10.0-3.6.1 |
| SUSE Manager Proxy 4.1 | python-Twisted | 19.10.0-3.6.1 |
| SUSE Manager Retail Branch Server 4.1 | python-Twisted | 19.10.0-3.6.1 |
| SUSE Manager Server 4.1 | python-Twisted | 19.10.0-3.6.1 |
| SUSE OpenStack Cloud 8 | python-Twisted | 15.2.1-9.11.1 |
| SUSE OpenStack Cloud 8 | python-Twisted | 15.2.1-9.23.1 |
| SUSE OpenStack Cloud 9 | python-Twisted | 15.2.1-9.11.1 |
| SUSE OpenStack Cloud 9 | python-Twisted | 15.2.1-9.23.1 |
| SUSE OpenStack Cloud Crowbar 8 | python-Twisted | 15.2.1-9.11.1 |
| SUSE OpenStack Cloud Crowbar 8 | python-Twisted | 15.2.1-9.23.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Twisted | 15.2.1-9.11.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Twisted | 15.2.1-9.23.1 |
| Ubuntu 18.04 LTS | twisted | 17.9.0-2ubuntu0.3 |
| Ubuntu 20.04 LTS | twisted | 18.9.0-11ubuntu0.20.04.2 |
| Ubuntu 22.04 LTS | twisted | 22.1.0-2ubuntu2 |
| Ubuntu Pro 14.04 LTS | twisted | no fix |
| Ubuntu Pro 16.04 LTS | twisted | no fix |
| openSUSE Leap 15.3 | python-Twisted | 19.10.0-3.6.1 |
| openSUSE Tumbleweed | python-Twisted | 22.1.0-1.1 |