In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.

The remote Redhat Enterprise Linux 6 host has one or more packages installed that are affected by a vulnerability that has been acknowledged by the vendor but will not be patched.

  - python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods (CVE-2019-12387)

Note that Nessus has not tested for this issue but has instead relied on the package manager's report that the package is installed.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-1091 advisory.

    [12.1.0-6]
    - Fix CVE-2019-12387 (HTTP Header Injection)     Resolves: rhbz#1721518

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4074-1 advisory.

  - In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an     attacker to inject invalid characters such as CRLF. (CVE-2019-12387)

  - In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two     content-length headers, it ignored the first header. When the second content-length value was set to zero,     the request body was interpreted as a pipelined request. (CVE-2020-10108)

  - twisted is an event-driven networking engine written in Python. In affected versions twisted exposes     cookies and authorization headers when following cross-origin redirects. This issue is present in the     `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to     upgrade. There are no known workarounds. (CVE-2022-21712)

  - Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host     header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource`     resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.
    In practice this should be very difficult to exploit as being able to modify the Host header of a normal     HTTP request implies that one is already in a privileged position. This issue was fixed in version     22.10.0rc1. There are no known workarounds. (CVE-2022-39348)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has python-twisted-web packages installed that are affected by multiple vulnerabilities:

  - In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an     attacker to inject invalid characters such as CRLF. (CVE-2019-12387)

  - In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two     content-length headers, it ignored the first header. When the second content-length value was set to zero,     the request body was interpreted as a pipelined request. (CVE-2020-10108)

  - In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a     content-length and a chunked encoding header, the content-length took precedence and the remainder of the     request body was interpreted as a pipelined request. (CVE-2020-10109)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote NewStart CGSL host, running version CORE 5.05 / MAIN 5.05, has python-twisted-web packages installed that are affected by multiple vulnerabilities:

  - In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an     attacker to inject invalid characters such as CRLF. (CVE-2019-12387)

  - In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two     content-length headers, it ignored the first header. When the second content-length value was set to zero,     the request body was interpreted as a pipelined request. (CVE-2020-10108)

  - In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a     content-length and a chunked encoding header, the content-length took precedence and the remainder of the     request body was interpreted as a pipelined request. (CVE-2020-10109)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An update of the python package has been released.

Twisted developers reports :

All HTTP clients in twisted.web.client now raise a ValueError when called with a method and/or URL that contain invalid characters. This mitigates CVE-2019-12387. Thanks to Alex Brasetvik for reporting this vulnerability.

The HTTP/2 server implementation now enforces TCP flow control on control frame messages and times out clients that send invalid data without reading responses. This closes CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood).
Thanks to Jonathan Looney and Piotr Sikora.

twisted.web.http was subject to several request smuggling attacks.
Requests with multiple Content-Length headers were allowed (CVE-2020-10108, thanks to Jake Miller from Bishop Fox and ZeddYu Lu for reporting this) and now fail with a 400; requests with a Content-Length header and a Transfer-Encoding header honored the first header (CVE-2020-10109, thanks to Jake Miller from Bishop Fox for reporting this) and now fail with a 400; requests whose Transfer-Encoding header had a value other than 'chunked' and 'identity' (thanks to ZeddYu Lu) were allowed and now fail with a 400.

* python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods

The remote CentOS Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1091 advisory.

  - In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an     attacker to inject invalid characters such as CRLF. (CVE-2019-12387)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1091 advisory.

    Twisted is an event-based framework for internet applications. Twisted Web is a complete web server, aimed     at hosting web applications using Twisted and Python, but fully able to serve static pages too.

    Security Fix(es):

    * python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods (CVE-2019-12387)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 16.04 LTS / 18.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-4308-1 advisory.

    it was discovered that Twisted incorrectly validated or sanitized certain URIs or HTTP methods. A remote     attacker could use this issue to inject invalid characters and possibly perform header injection attacks.
    (CVE-2019-12387)

    It was discovered that Twisted incorrectly verified XMPP TLS certificates. A remote attacker could     possibly use this issue to perform a machine-in-the-middle attack and obtain sensitive information.
    (CVE-2019-12855)

    It was discovered that Twisted incorrectly handled HTTP/2 connections. A remote attacker could possibly     use this issue to cause Twisted to hang or consume resources, leading to a denial of service. This issue     only affected Ubuntu 18.04 LTS and Ubuntu 19.10. (CVE-2019-9512, CVE-2019-9514, CVE-2019-9515)

    Jake Miller and ZeddYu Lu discovered that Twisted incorrectly handled certain content-length headers. A     remote attacker could possibly use this issue to perform HTTP request splitting attacks. (CVE-2020-10108,     CVE-2020-10109)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2019:3172 advisory.

    Red Hat Satellite is a systems management tool for Linux-based infrastructure. It allows for provisioning,     remote management, and monitoring of multiple Linux deployments with a single centralized tool.

    Security Fix(es):

    * rubygem-rack: Buffer size in multipart parser allows for denial of service (CVE-2018-16470)

    * dom4j: XML Injection in Class: Element. Methods: addElement, addAttribute which can impact the integrity     of XML documents (CVE-2018-1000632)

    * foreman: authorization bypasses in foreman-tasks leading to information disclosure (CVE-2019-10198)

    * katello: registry credentials are captured in plain text during repository discovery (CVE-2019-14825)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    This update also fixes several bugs and adds various enhancements. Documentation for these changes is     available from the Release Notes document linked to in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for python-Twisted fixes the following issue :

Security issue fixed :

CVE-2019-12387: Fixed an improper sanitization of URIs or HTTP which could have allowed attackers to perfrom CRLF attacks (bsc#1137825).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Fix CVE-2019-12387 (rhbz#1719503) (rhbz#1719501)

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for python-Twisted fixes the following issue :

Security issue fixed: &#9; 

  - CVE-2019-12387: Fixed an improper sanitization of URIs     or HTTP which could have allowed attackers to perfrom     CRLF attacks (bsc#1137825).

This update was imported from the SUSE:SLE-15:Update update project.

ID	Name	Product	Family	Severity
199128	RHEL 6 : python-twisted (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	medium
180658	Oracle Linux 7 : python-twisted-web (ELSA-2020-1091)	Nessus	Oracle Linux Local Security Checks	medium
167952	SUSE SLES12 Security Update : python-Twisted (SUSE-SU-2022:4074-1)	Nessus	SuSE Local Security Checks	critical
144086	NewStart CGSL CORE 5.04 / MAIN 5.04 : python-twisted-web Multiple Vulnerabilities (NS-SA-2020-0078)	Nessus	NewStart CGSL Local Security Checks	critical
143976	NewStart CGSL CORE 5.05 / MAIN 5.05 : python-twisted-web Multiple Vulnerabilities (NS-SA-2020-0118)	Nessus	NewStart CGSL Local Security Checks	critical
138519	Photon OS 1.0: Python PHSA-2020-1.0-0307	Nessus	PhotonOS Local Security Checks	high
138513	Photon OS 2.0: Python PHSA-2020-2.0-0260	Nessus	PhotonOS Local Security Checks	high
135883	FreeBSD : py-twisted -- multiple vulnerabilities (9fbaefb3-837e-11ea-b5b4-641c67a117d8) (Ping Flood) (Reset Flood) (Settings Flood)	Nessus	FreeBSD Local Security Checks	critical
135832	Scientific Linux Security Update : python-twisted-web on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	medium
135335	CentOS 7 : python-twisted-web (RHSA-2020:1091)	Nessus	CentOS Local Security Checks	medium
135055	RHEL 7 : python-twisted-web (RHSA-2020:1091)	Nessus	Red Hat Local Security Checks	medium
134758	Ubuntu 16.04 LTS / 18.04 LTS : Twisted vulnerabilities (USN-4308-1)	Nessus	Ubuntu Local Security Checks	critical
130187	RHEL 7 : Red Hat Satellite 6 (RHSA-2019:3172)	Nessus	Red Hat Local Security Checks	high
127771	SUSE SLES12 Security Update : python-Twisted (SUSE-SU-2019:2066-1)	Nessus	SuSE Local Security Checks	medium
127525	Fedora 29 : python-twisted (2019-b67877d7c2)	Nessus	Fedora Local Security Checks	medium
126900	openSUSE Security Update : python-Twisted (openSUSE-2019-1760)	Nessus	SuSE Local Security Checks	medium
126497	SUSE SLED15 / SLES15 Security Update : python-Twisted (SUSE-SU-2019:1731-1)	Nessus	SuSE Local Security Checks	medium

Detections

Analytics

CVE-2019-12387

medium

Tenable Plugins

medium

medium

critical

critical

critical

high

high

critical

medium

medium

medium

critical

high

medium

medium

medium

medium