CVE-2022-21716: Twisted SSH client and server deny of service during SSH handshake.
(updated )
The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer’s SSH version identifier.
A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as nc -rv localhost 22 < /dev/zero.
References
- github.com/advisories/GHSA-rv6r-3f5q-9rgx
- github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2022-160.yaml
- github.com/twisted/twisted
- github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9
- github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1
- github.com/twisted/twisted/releases/tag/twisted-22.2.0
- github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx
- lists.debian.org/debian-lts-announce/2022/03/msg00009.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6
- nvd.nist.gov/vuln/detail/CVE-2022-21716
- security.gentoo.org/glsa/202301-02
- twistedmatrix.com/trac/ticket/10284
- www.oracle.com/security-alerts/cpuapr2022.html
Code Behaviors & Features
Detect and mitigate CVE-2022-21716 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →