CVE-2022-21716
Fixed in a distro release EPSS 4%CVSS 7.5
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.
Products: twisted
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | twisted | 22.2.0 |
| PyPI | twisted | 89c395ee794e85a9657b112c4351417850330ef9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | python3-twisted | 22.4.0-124.amzn2023.0.2 |
| Amazon Linux 2023 | python3-twisted+tls | 22.4.0-124.amzn2023.0.2 |
| Arch Linux | python-twisted | no fix |
| Debian 12 | twisted | 22.2.0-1 |
| Debian 13 | twisted | 22.2.0-1 |
| Debian 14 | twisted | 22.2.0-1 |
| Debian 9 | twisted | 16.6.0-2+deb9u2 |
| Red Hat openstack 16.1 | python-twisted | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.1 | python-twisted-debugsource | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.1 | python3-twisted | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.1 | python3-twisted-debuginfo | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.2 | python-twisted | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.2 | python-twisted-debugsource | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.2 | python3-twisted | 0:16.4.1-19.el8ost |
| Red Hat openstack 16.2 | python3-twisted-debuginfo | 0:16.4.1-19.el8ost |
| SUSE Enterprise Storage 7 | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE HPE Helion OpenStack 8 | python-Twisted | 15.2.1-9.17.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-ESPOS | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP3 | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP3 | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP4 | python-Twisted | 22.2.0-150400.5.4.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | python-Twisted | 15.2.1-9.17.1 |
| SUSE Linux Enterprise Server 15 SP2-BCL | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE Manager Proxy 4.1 | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE Manager Retail Branch Server 4.1 | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE Manager Server 4.1 | python-Twisted | 19.10.0-150200.3.12.1 |
| SUSE OpenStack Cloud 8 | python-Twisted | 15.2.1-9.17.1 |
| SUSE OpenStack Cloud 9 | python-Twisted | 15.2.1-9.17.1 |
| SUSE OpenStack Cloud Crowbar 8 | python-Twisted | 15.2.1-9.17.1 |
| SUSE OpenStack Cloud Crowbar 9 | python-Twisted | 15.2.1-9.17.1 |
| Ubuntu 18.04 LTS | twisted | 17.9.0-2ubuntu0.3 |
| Ubuntu 20.04 LTS | twisted | 18.9.0-11ubuntu0.20.04.2 |
| Ubuntu 22.04 LTS | twisted | 22.1.0-2ubuntu2.1 |
| Ubuntu Pro 14.04 LTS | twisted | 13.2.0-1ubuntu1.2+esm2 |
| Ubuntu Pro 16.04 LTS | twisted | 16.0.0-1ubuntu0.4+esm1 |
| openSUSE Leap 15.3 | python-Twisted | 19.10.0-150200.3.12.1 |
| openSUSE Leap 15.4 | python-Twisted | 19.10.0-150200.3.12.1 |
| openSUSE Leap 15.4 | python-Twisted | 22.2.0-150400.5.4.1 |
| openSUSE Tumbleweed | python-Twisted | 22.2.0-1.1 |