ghsa-rv6r-3f5q-9rgx
Vulnerability from github
Published
2022-03-03 19:02
Modified
2022-03-04 21:09
Severity
Summary
Twisted SSH client and server deny of service during SSH handshake.
Details
Impact
The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier.
A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as nc -rv localhost 22 < /dev/zero.
Patches
The issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1
A fix is available in Twisted 22.2.0.
Workarounds
- Limit access to the SSH server only to trusted source IP addresses.
- Connect over SSH only to trusted destination IP addresses.
References
Reported at https://twistedmatrix.com/trac/ticket/10284 Discussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx
For more information
Found by vin01
{
"affected": [
{
"ecosystem_specific": {
"affected_functions": [
"twisted.conch.ssh.transport.SSHTransportBase.dataReceived"
]
},
"package": {
"ecosystem": "PyPI",
"name": "twisted"
},
"ranges": [
{
"events": [
{
"introduced": "21.7.0"
},
{
"fixed": "22.2.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-21716"
],
"database_specific": {
"cwe_ids": [
"CWE-120",
"CWE-770"
],
"github_reviewed": true,
"github_reviewed_at": "2022-03-03T19:02:08Z",
"nvd_published_at": "2022-03-03T21:15:00Z",
"severity": "HIGH"
},
"details": "### Impact\n\nThe Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer\u0027s SSH version identifier.\n\nA malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as `nc -rv localhost 22 \u003c /dev/zero`.\n\n### Patches\n\nThe issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1\n\nA fix is available in Twisted 22.2.0.\n\n### Workarounds\n\n* Limit access to the SSH server only to trusted source IP addresses.\n* Connect over SSH only to trusted destination IP addresses.\n\n### References\n\nReported at https://twistedmatrix.com/trac/ticket/10284\nDiscussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx\n\n### For more information\n\nFound by vin01",
"id": "GHSA-rv6r-3f5q-9rgx",
"modified": "2022-03-04T21:09:55Z",
"published": "2022-03-03T19:02:08Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-21716"
},
{
"type": "WEB",
"url": "https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1"
},
{
"type": "PACKAGE",
"url": "https://github.com/twisted/twisted"
},
{
"type": "WEB",
"url": "https://github.com/twisted/twisted/releases/tag/twisted-22.2.0"
},
{
"type": "WEB",
"url": "https://lists.debian.org/debian-lts-announce/2022/03/msg00009.html"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/202301-02"
},
{
"type": "WEB",
"url": "https://twistedmatrix.com/trac/ticket/10284"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpuapr2022.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Twisted SSH client and server deny of service during SSH handshake."
}
Loading...