Stay Secure with the Latest Linux Advisories

security advisorysecurity updatecritical

Mageia 8 MGASA-2023-0061 Critical: HTML Injection in Python-Twisted

When the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. (CVE-2022-39348) . MGASA-2023-0061 - Updated python-twisted packages fix security vulnerability Publication date: 27 Feb 2023 URL: https://advisories.mageia.org/MGASA-2023-0061.html Type: security Affected Mageia releases: 8 CVE: CVE-2022-39348 When the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. (CVE-2022-39348) References: - https://bugs.mageia.org/show_bug.cgi?id=31140 - https://lists.suse.com/pipermail/sle-security-updates/2022-November/012932.html - - https://lists.debian.org/debian-lts-announce/2022/11/msg00038.html - https://www.cve.org/CVERecord?id=CVE-2022-39348 SRPMS: - 8/core/python-twisted-22.10.0-1.mga8 . MGASA-2023-0072 releases an update for python-flask, addressing severe vulnerabilities in configuration handling, strengthening application integrity.. Python Twisted Injection, Mageia Security Update, HTML Injection Prevention. . Severity: Critical. LinuxSecurity.com Team

Feb 27, 2023 •Critical Mageia