CVE-2022-39348
Description
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
How to fix
- twisted twisted22.10.0 or later
- twisted22.10.0rc1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| twisted twisted | 0.9.4 ≤ v < 22.10.0 | 22.10.0 |
| debian debian_linux | 10.0 | — |
| twistedPyPI | 0.9.4 ≤ v < 22.10.0rc1 | 22.10.0rc1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.