Debian LTS DLA-3970-1: twisted security issues and updates

CVE-2022-39348

When the host header does not match a configured host
`twisted.web.vhost.NameVirtualHost` will return a `NoResource`
resource which renders the Host header unescaped into the 404
response allowing HTML and script injection. In practice this
should be very difficult to exploit as being able to modify the
Host header of a normal HTTP request implies that one is already
in a privileged position.

CVE-2023-46137

When sending multiple HTTP requests in one TCP packet, twisted.web
will process the requests asynchronously without guaranteeing the
response order. If one of the endpoints is controlled by an
attacker, the attacker can delay the response on purpose to
manipulate the response of the second request when a victim
launched two requests using HTTP pipeline.

CVE-2024-41671

The HTTP 1.0 and 1.1 server provided by twisted.web could process
pipelined HTTP requests out-of-order, possibly resulting in
information disclosure.