CVE-2022-21712

Published: 7 February 2022

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.

Priority

CVSS 3 base score: 7.5

Status

Package	Release	Status
twisted Launchpad, Ubuntu, Debian	bionic	Released (17.9.0-2ubuntu0.3)
	focal	Released (18.9.0-11ubuntu0.20.04.2)
	impish	Released (20.3.0-7ubuntu1.1)
	jammy	Released (22.1.0-2ubuntu2)
	trusty	Needed
	upstream	Released (22.1.0)
	xenial	Needed

References

https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21712
https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx
https://github.com/twisted/twisted/releases/tag/twisted-22.1.0
https://ubuntu.com/security/notices/USN-5354-1
NVD
Launchpad
Debian

Bugs

Join the discussion

Ubuntu security updates mailing list
Security announcements mailing list

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›