PyPi: Twisted

CVE-2022-21716

Safety vulnerability ID: 45554

This vulnerability was reviewed by experts

The information on this page was manually curated by our Cybersecurity Intelligence Team.

Created at Mar 03, 2022 Updated at Nov 22, 2024
Scan your Python projects for vulnerabilities →

Advisory

Twisted 22.2.0 includes a fix for CVE-2022-21716: Prior to 22.2.0, Twisted SSH client and server implementation is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory.
https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx

Affected package

twisted

Latest version: 24.10.0

An asynchronous networking framework written in Python

Affected versions

Fixed versions

Vulnerability changelog

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds. See CVE-2022-21716.


CONFIRM:https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx: https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx
MISC:https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9: https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9
MISC:https://github.com/twisted/twisted/releases/tag/twisted-22.2.0: https://github.com/twisted/twisted/releases/tag/twisted-22.2.0
MISC:https://twistedmatrix.com/trac/ticket/10284: https://twistedmatrix.com/trac/ticket/10284

Resources

Use this package?

Scan your Python project for dependency vulnerabilities in two minutes

Scan your application

Severity Details

CVSS Base Score

HIGH 7.5

CVSS v3 Details

HIGH 7.5
Attack Vector (AV)
NETWORK
Attack Complexity (AC)
LOW
Privileges Required (PR)
NONE
User Interaction (UI)
NONE
Scope (S)
UNCHANGED
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Availability (A)
HIGH

CVSS v2 Details

MEDIUM 5.0
Access Vector (AV)
NETWORK
Access Complexity (AC)
LOW
Authentication (Au)
NONE
Confidentiality Impact (C)
NONE
Integrity Impact (I)
NONE
Availability Impact (A)
PARTIAL