CVE-2020-10109

Published: 12 March 2020

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.

Priority

CVSS 3 base score: 9.8

Status

Package	Release	Status
twisted Launchpad, Ubuntu, Debian	bionic	Released (17.9.0-2ubuntu0.1)
	eoan	Released (18.9.0-3ubuntu1.1)
	precise	Not vulnerable (code not present)
	trusty	Released (13.2.0-1ubuntu1.2+esm1)
	upstream	Needs triage
	xenial	Released (16.0.0-1ubuntu0.4)

Notes

Author	Note
mdeslaur	same commit as CVE-2020-10108

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10109
https://ubuntu.com/security/notices/USN-4308-1
https://ubuntu.com/security/notices/USN-4308-2
NVD
Launchpad
Debian

Bugs

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›