CVE-2024-41810
Fixed in a distro release EPSS 1%CVSS 6.1
Twisted is an event-based framework for internet applications, supporting Python 3.6+. The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body. This vulnerability is fixed in 24.7.0rc1.
Products: twisted, twistedmatrix twisted
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| PyPI | twisted | 24.7.0rc1 |
| PyPI | twisted | 046a164f89a0f08d3239ecebd750360f8914df33 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Amazon Linux 2023 | python3-twisted | 22.4.0-127.amzn2023.0.4 |
| Amazon Linux 2023 | python3-twisted+tls | 22.4.0-127.amzn2023.0.4 |
| Debian 11 | twisted | 20.3.0-7+deb11u2 |
| Debian 12 | twisted | 22.4.0-4+deb12u1 |
| Debian 13 | twisted | 24.7.0-1 |
| Debian 14 | twisted | 24.7.0-1 |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.12-1.el8ap |
| Red Hat ansible automation platform 2.4 | automation-controller-venv-tower | 0:4.5.12-1.el9ap |
| SUSE Enterprise Storage 7.1 | python-Twisted | 19.10.0-150200.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS | python-Twisted | 19.10.0-150200.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS | python-Twisted | 19.10.0-150200.3.24.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python-Twisted | 22.10.0-150400.5.23.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS | python3-Twisted | 22.2.0-150400.21.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python-Twisted | 22.10.0-150400.5.23.1 |
| SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS | python3-Twisted | 22.2.0-150400.21.1 |
| SUSE Linux Enterprise Module for Public Cloud 15 SP4 | python-Twisted | 22.10.0-150400.5.23.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP5 | python-Twisted | 22.10.0-150400.5.23.1 |
| SUSE Linux Enterprise Module for Python 3 15 SP6 | python-Twisted | 22.10.0-150400.5.23.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP5 | python3-Twisted | 22.2.0-150400.21.1 |
| SUSE Linux Enterprise Module for Server Applications 15 SP6 | python3-Twisted | 22.2.0-150400.21.1 |
| SUSE Linux Enterprise Module for Web and Scripting 12 | python-Twisted | 15.2.1-9.26.1 |
| SUSE Linux Enterprise Server 15 SP2-LTSS | python-Twisted | 19.10.0-150200.3.24.1 |
| SUSE Linux Enterprise Server 15 SP3-LTSS | python-Twisted | 19.10.0-150200.3.24.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python-Twisted | 22.10.0-150400.5.23.1 |
| SUSE Linux Enterprise Server 15 SP4-LTSS | python3-Twisted | 22.2.0-150400.21.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP2 | python-Twisted | 19.10.0-150200.3.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP3 | python-Twisted | 19.10.0-150200.3.24.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python-Twisted | 22.10.0-150400.5.23.1 |
| SUSE Linux Enterprise Server for SAP Applications 15 SP4 | python3-Twisted | 22.2.0-150400.21.1 |
| SUSE Manager Proxy 4.3 | python3-Twisted | 22.2.0-150400.21.1 |
| SUSE Manager Server 4.3 | python3-Twisted | 22.2.0-150400.21.1 |
| Ubuntu 20.04 LTS | twisted | 18.9.0-11ubuntu0.20.04.4 |
| Ubuntu 22.04 LTS | twisted | 22.1.0-2ubuntu2.5 |
| Ubuntu 24.04 LTS | twisted | 24.3.0-1ubuntu0.1 |
| Ubuntu Pro 14.04 LTS | twisted | 13.2.0-1ubuntu1.2+esm3 |
| Ubuntu Pro 16.04 LTS | twisted | 16.0.0-1ubuntu0.4+esm2 |
| Ubuntu Pro 18.04 LTS | twisted | 17.9.0-2ubuntu0.3+esm1 |
| openSUSE Leap 15.5 | python-Twisted | 22.10.0-150400.5.23.1 |
| openSUSE Leap 15.5 | python3-Twisted | 22.2.0-150400.21.1 |
| openSUSE Leap 15.6 | python-Twisted | 22.10.0-150400.5.23.1 |
| openSUSE Tumbleweed | python-Twisted | 24.3.0-2.1 |