Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

suse-cvrf логотип

SUSE-SU-2022:4000-1

Опубликовано: 15 нояб. 2022
Источник: suse-cvrf

Описание

Security update for python-Twisted

This update for python-Twisted fixes the following issues:

  • CVE-2022-39348: Fixed NameVirtualHost Host header injection (bsc#1204781).

Список пакетов

SUSE Linux Enterprise Module for Server Applications 15 SP4
python3-Twisted-22.2.0-150400.5.7.1
openSUSE Leap 15.4
python-Twisted-doc-22.2.0-150400.5.7.1
python3-Twisted-22.2.0-150400.5.7.1

Ссылки

Описание

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.

Затронутые продукты
SUSE Linux Enterprise Module for Server Applications 15 SP4:python3-Twisted-22.2.0-150400.5.7.1
openSUSE Leap 15.4:python-Twisted-doc-22.2.0-150400.5.7.1
openSUSE Leap 15.4:python3-Twisted-22.2.0-150400.5.7.1
Ссылки
Уязвимость SUSE-SU-2022:4000-1