It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS-2023-1717 advisory.

    A flaw was found in python-twisted. This vulnerability occurs due to the parsing of illegal constructs in     the twisted.web.http module. The illegal constructs include '+/-' in the Content-Length header, '\n and     \t' etc. Non-conformant parsing leads to a desync if requests pass through multiple HTTP parsers. This     flaw allows a remote attacker to perform an HTTP request smuggling attack. (CVE-2022-24801)

    Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host     header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource`     resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.
    In practice this should be very difficult to exploit as being able to modify the Host header of a normal     HTTP request implies that one is already in a privileged position. This issue was fixed in version     22.10.0rc1. There are no known workarounds. (CVE-2022-39348)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Amazon Linux AMI : python-twisted-web (ALAS-2023-1717)

high Nessus Plugin ID 173953

Version 1.2