Ubuntu 23.10: USN-6575-1 Critical Twisted HTML Injection

ubuntu

January 10, 2024

Several security issues were fixed in Twisted.

Summary

Several security issues were fixed in Twisted.

Software Description:

- twisted: Event-based framework for internet applications

Details:

It was discovered that Twisted incorrectly escaped host headers in certain

404 responses. A remote attacker could possibly use this issue to perform

HTML and script injection attacks. This issue only affected Ubuntu 20.04

LTS and Ubuntu 22.04 LTS. (CVE-2022-39348)

It was discovered that Twisted incorrectly handled response order when

processing multiple HTTP requests. A remote attacker could possibly use

this issue to delay responses and manipulate the responses of second

requests. (CVE-2023-46137)

Topics Covered

security advisory critical ubuntu html injection twisted response manipulation

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 23.10:
   python3-twisted                 22.4.0-4ubuntu0.23.10.1

Ubuntu 23.04:
   python3-twisted                 22.4.0-4ubuntu0.23.04.1

Ubuntu 22.04 LTS:
   python3-twisted                 22.1.0-2ubuntu2.4

Ubuntu 20.04 LTS:
   python3-twisted                 18.9.0-11ubuntu0.20.04.3

In general, a standard system update will make all the necessary changes.