This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-10108 →

DEBIAN-CVE-2020-10108

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the firs...

Original description

The description as published by the source.

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 twisted

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-7"}]}]

Debian:13 twisted

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-7"}]}]

Debian:14 twisted

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-7"}]}]

References

advisory security-tracker.debian.org