Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.
References
Configurations
Configuration 1 (hide)
|
Configuration 2 (hide)
|
Configuration 3 (hide)
|
Configuration 4 (hide)
|
History
25 Nov 2024, 18:12
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:* | |
First Time |
Twisted twisted
Twisted |
21 Nov 2024, 06:45
Type | Values Removed | Values Added |
---|---|---|
References | () https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9 - Patch, Third Party Advisory | |
References | () https://github.com/twisted/twisted/releases/tag/twisted-22.2.0 - Release Notes, Third Party Advisory | |
References | () https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx - Exploit, Patch, Third Party Advisory | |
References | () https://lists.debian.org/debian-lts-announce/2022/03/msg00009.html - Mailing List, Third Party Advisory | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/ - | |
References | () https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6/ - | |
References | () https://security.gentoo.org/glsa/202301-02 - Third Party Advisory | |
References | () https://twistedmatrix.com/trac/ticket/10284 - Issue Tracking, Vendor Advisory | |
References | () https://www.oracle.com/security-alerts/cpuapr2022.html - Patch, Third Party Advisory |
07 Nov 2023, 03:43
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
24 Jul 2023, 13:47
Type | Values Removed | Values Added |
---|---|---|
CWE | CWE-770 |
Information
Published : 2022-03-03 21:15
Updated : 2024-11-25 18:12
NVD link : CVE-2022-21716
Mitre link : CVE-2022-21716
CVE.ORG link : CVE-2022-21716
JSON object : View
Products Affected
debian
- debian_linux
oracle
- http_server
- zfs_storage_appliance_kit
twisted
- twisted
fedoraproject
- fedora