CVE-2016-1000111

Advisory

Twisted Web 16.4.0 includes the following three security fixes:
- A bug in twisted.web.server.Site.makeSession which may lead to predictable session IDs was fixed. Session IDs are now generated securely using `os.urandom`.
- twisted.web.server.Request.getSession will now, for a request sent over HTTPS, set a "Secure" cookie, preventing the secure session from being sent over plain-text HTTP.
- twisted.web.twcgi.CGIScript will now not pass the "Proxy" header to CGI scripts, as a mitigation to CVE-2016-1000111.

Affected package

Affected versions

Fixed versions

Vulnerability changelog

This vulnerability has no description

Resources

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-1000111
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2016-3090545.html
• https://www.openwall.com/lists/oss-security/2016/07/18/6
• https://twistedmatrix.com/trac/ticket/8623
• https://twistedmatrix.com/pipermail/twisted-web/2016-August/005268.html