CVE-2022-24801: Inconsistent Interpretation of HTTP Requests in twisted.web
(updated )
The Twisted Web HTTP 1.1 server, located in the twisted.web.http module, parsed several HTTP request constructs more leniently than permitted by RFC 7230:
- The Content-Length header value could have a
+or-prefix. - Illegal characters were permitted in chunked extensions, such as the LF (
\n) character. - Chunk lengths, which are expressed in hexadecimal format, could have a prefix of
0x. - HTTP headers were stripped of all leading and trailing ASCII whitespace, rather than only space and HTAB (
\t).
This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling.
References
- github.com/advisories/GHSA-c2jg-hw38-jrqq
- github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2022-195.yaml
- github.com/twisted/twisted
- github.com/twisted/twisted/commit/592217e951363d60e9cd99c5bbfd23d4615043ac
- github.com/twisted/twisted/releases/tag/twisted-22.4.0rc1
- github.com/twisted/twisted/security/advisories/GHSA-c2jg-hw38-jrqq
- lists.debian.org/debian-lts-announce/2022/05/msg00003.html
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6
- nvd.nist.gov/vuln/detail/CVE-2022-24801
- www.oracle.com/security-alerts/cpujul2022.html
Code Behaviors & Features
Detect and mitigate CVE-2022-24801 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →