CVE-2022-21716highCWE-120

CVE-2022-21716: falha de alta gravidade em twisted

Buffer Overflow in Twisted

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar twisted+ Monitorar twisted

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

21Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 7.5epss 3.5%
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Produtos afetados
twisted · twisted
CVEs relacionadas — twisted

No mesmo produto, das mais perigosas para as menos.

CVE-2022-24801HIGHHTTP Request Smuggling in twisted.webEPSS 2.8%CVE-2022-39348MEDIUMTwisted vulnerable to NameVirtualHost Host header injectionEPSS 1.6%CVE-2022-21712HIGHCookie and header exposure in twistedEPSS 1.4%CVE-2024-41810MEDIUMHTML injection in HTTP redirect bodyEPSS 1.2%CVE-2023-46137MEDIUMtwisted.web has disordered HTTP pipeline responseEPSS 0.9%CVE-2024-41671HIGHtwisted.web has disordered HTTP pipeline responseEPSS 0.9%