Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:0322 advisory.

  - GitPython: Blind local file inclusion (CVE-2023-41040)

  - python-twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 / 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2024:1640 advisory.

  - golang: net/http/internal: Denial of Service (DoS) via Resource Consumption via HTTP requests     (CVE-2023-39326)

  - GitPython: Blind local file inclusion (CVE-2023-41040)

  - axios: exposure of confidential data stored in cookies (CVE-2023-45857)

  - python-twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)

  - python-aiohttp: numerous issues in HTTP parser with header parsing (CVE-2023-47627)

  - python-cryptography: NULL-dereference when loading PKCS7 certificates (CVE-2023-49083)

  - golang-fips/openssl: Memory leaks in code encrypting and decrypting RSA payloads (CVE-2024-1394)

  - jinja2: HTML attribute injection when passing user input as keys to xmlattr filter (CVE-2024-22195)

  - aiohttp: follow_symlinks directory traversal vulnerability (CVE-2024-23334)

  - python-aiohttp: http request smuggling (CVE-2024-23829)

  - Django: denial-of-service in ``intcomma`` template filter (CVE-2024-24680)

  - python-django: Potential regular expression denial-of-service in django.utils.text.Truncator.words()     (CVE-2024-27351)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1518 advisory.

  - python-twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2024:1516 advisory.

  - python-twisted: disordered HTTP pipeline response in twisted.web (CVE-2023-46137)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6575-1 advisory.

  - Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host     header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource`     resource which renders the Host header unescaped into the 404 response allowing HTML and script injection.
    In practice this should be very difficult to exploit as being able to modify the Host header of a normal     HTTP request implies that one is already in a privileged position. This issue was fixed in version     22.10.0rc1. There are no known workarounds. (CVE-2022-39348)

  - Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending     multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without     guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can     delay the response on purpose to manipulate the response of the second request when a victim launched two     requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue. (CVE-2023-46137)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4830-1 advisory.

  - Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending     multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without     guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can     delay the response on purpose to manipulate the response of the second request when a victim launched two     requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue. (CVE-2023-46137)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 / openSUSE 15 host has a package installed that is affected by a vulnerability as referenced in the SUSE-SU-2023:4607-1 advisory.

  - Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending     multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without     guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can     delay the response on purpose to manipulate the response of the second request when a victim launched two     requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue. (CVE-2023-46137)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLED15 / SLED_SAP15 / SLES15 / SLES_SAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:4608-1 advisory.

  - Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending     multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without     guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can     delay the response on purpose to manipulate the response of the second request when a victim launched two     requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue. (CVE-2023-46137)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-432 advisory.

  - Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending     multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without     guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can     delay the response on purpose to manipulate the response of the second request when a victim launched two     requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue. (CVE-2023-46137)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
194438	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:0322)	Nessus	Red Hat Local Security Checks	medium
193086	RHEL 8 / 9 : Red Hat Ansible Automation Platform 2.4 Product Security and Bug Fix Update (Moderate) (RHSA-2024:1640)	Nessus	Red Hat Local Security Checks	high
192583	RHEL 8 : Red Hat OpenStack Platform 16.2.6 (python-twisted) (RHSA-2024:1518)	Nessus	Red Hat Local Security Checks	medium
192580	RHEL 8 : Red Hat OpenStack Platform 16.1.9 (python-twisted) (RHSA-2024:1516)	Nessus	Red Hat Local Security Checks	medium
187918	Ubuntu 20.04 LTS / 22.04 LTS / 23.04 / 23.10 : Twisted vulnerabilities (USN-6575-1)	Nessus	Ubuntu Local Security Checks	medium
186998	SUSE SLES15 Security Update : python-Twisted (SUSE-SU-2023:4830-1)	Nessus	SuSE Local Security Checks	medium
186465	SUSE SLES15 / openSUSE 15 Security Update : python3-Twisted (SUSE-SU-2023:4607-1)	Nessus	SuSE Local Security Checks	medium
186464	SUSE SLED15 / SLES15 / openSUSE 15 Security Update : python-Twisted (SUSE-SU-2023:4608-1)	Nessus	SuSE Local Security Checks	medium
185716	Amazon Linux 2023 : python3-twisted, python3-twisted+tls (ALAS2023-2023-432)	Nessus	Amazon Linux Local Security Checks	medium

Detections

Analytics

CVE-2023-46137

medium

Tenable Plugins

medium

high

medium

medium

medium

medium

medium

medium

medium