CVE-2024-41671 — twisted.web has disordered HTTP pipeline response

Affected: twisted

Twisted is an event-based framework for internet applications, supporting Python 3.6+. The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure. This vulnerability is fixed in 24.7.0rc1.

USN-6988-1 — twisted vulnerabilities

Affected: Ubuntu:Pro:14.04:LTS: twisted, Ubuntu:Pro:16.04:LTS: twisted, Ubuntu:Pro:18.04:LTS: twisted, Ubuntu:20.04:LTS: twisted, Ubuntu:22.04:LTS: twisted, Ubuntu:24.04:LTS: twisted

Ben Kallus discovered that Twisted incorrectly handled response order when processing multiple HTTP requests. A remote attacker could possibly use this issue to delay and manipulate responses. This issue only affected Ubuntu 24.04 LTS. (CVE-2024-41671)

It was discovered that Twisted did not properly sanitize certain input. An attacker could use this vulnerability to possibly execute an HTML injection leading to a cross-site scripting (XSS) attack. (CVE-2024-41810)

Most recent entries from all

CVE-2024-41671 — twisted.web has disordered HTTP pipeline response

USN-6988-1 — twisted vulnerabilities