Detections
Analytics

Debian dla-3970 : python3-twisted - security update

medium Nessus Plugin ID 211959

Language:

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3970 advisory.

 - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3970-1 [email protected] https://www.debian.org/lts/security/ Sylvain Beucler November 28, 2024 https://wiki.debian.org/LTS
 - -------------------------------------------------------------------------

 Package : twisted Version : 20.3.0-7+deb11u2 CVE ID : CVE-2022-39348 CVE-2023-46137 CVE-2024-41671 CVE-2024-41810 Debian Bug : 1023359 1054913 1077679 1077680

 Multiple security issues were found in Twisted, an event-based framework for internet applications, which could result in incorrect ordering of HTTP requests or cross-site scripting.

 CVE-2022-39348

 When the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position.

 CVE-2023-46137

 When sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline.

 CVE-2024-41671

 The HTTP 1.0 and 1.1 server provided by twisted.web could process pipelined HTTP requests out-of-order, possibly resulting in information disclosure.

 CVE-2024-41810

 The `twisted.web.util.redirectTo` function contains an HTML injection vulnerability. If application code allows an attacker to control the redirect URL this vulnerability may result in Reflected Cross-Site Scripting (XSS) in the redirect response HTML body.

 For Debian 11 bullseye, these problems have been fixed in version 20.3.0-7+deb11u2.

 We recommend that you upgrade your twisted packages.

 For the detailed security status of twisted please refer to its security tracker page at:
 https://security-tracker.debian.org/tracker/twisted

 Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the python3-twisted packages.

See Also

https://security-tracker.debian.org/tracker/source-package/twisted

https://security-tracker.debian.org/tracker/CVE-2022-39348

https://security-tracker.debian.org/tracker/CVE-2023-46137

https://security-tracker.debian.org/tracker/CVE-2024-41671

https://security-tracker.debian.org/tracker/CVE-2024-41810

https://packages.debian.org/source/bullseye/twisted

Plugin Details

Severity: Medium

ID: 211959

File Name: debian_DLA-3970.nasl

Version: 1.1

Type: local

Agent: unix

Published: 11/28/2024

Updated: 11/28/2024

Supported Sensors: Frictionless Assessment Agent, Nessus Agent, Agentless Assessment, Continuous Assessment, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 4.0

CVSS v2

Risk Factor: Medium

Base Score: 6.4

Temporal Score: 5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N

CVSS Score Source: CVE-2024-41810

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:python3-twisted-bin-dbg, p-cpe:/a:debian:debian_linux:twisted-doc, p-cpe:/a:debian:debian_linux:python3-twisted, p-cpe:/a:debian:debian_linux:python3-twisted-bin

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 11/28/2024

Vulnerability Publication Date: 10/26/2022

Reference Information

CVE: CVE-2022-39348, CVE-2023-46137, CVE-2024-41671, CVE-2024-41810