Security update for python-Twisted SUSE Patch security@suse.de SUSE Security Team SUSE-SU-2022:4057-1 Final 1 1 2022-11-17T14:39:26Z current 2022-11-17T14:39:26Z 2022-11-17T14:39:26Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for python-Twisted This update for python-Twisted fixes the following issues: - CVE-2022-39348: Fixed NameVirtualHost Host header injection (bsc#1204781). The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). SUSE-2022-4057,SUSE-SLE-Module-Packagehub-Subpackages-15-SP3-2022-4057,SUSE-SLE-Module-Server-Applications-15-SP3-2022-4057,openSUSE-SLE-15.3-2022-4057,openSUSE-SLE-15.4-2022-4057 Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://www.suse.com/support/update/announcement/2022/suse-su-20224057-1/ Link for SUSE-SU-2022:4057-1 https://lists.suse.com/pipermail/sle-security-updates/2022-November/012969.html E-Mail link for SUSE-SU-2022:4057-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings https://bugzilla.suse.com/1204781 SUSE Bug 1204781 https://www.suse.com/security/cve/CVE-2022-39348/ SUSE CVE CVE-2022-39348 page SUSE Linux Enterprise Module for Package Hub 15 SP3 SUSE Linux Enterprise Module for Server Applications 15 SP3 openSUSE Leap 15.3 openSUSE Leap 15.4 python-Twisted-doc-19.10.0-150200.3.18.1 python2-Twisted-19.10.0-150200.3.18.1 python3-Twisted-19.10.0-150200.3.18.1 python3-Twisted-19.10.0-150200.3.18.1 as a component of SUSE Linux Enterprise Module for Package Hub 15 SP3 python3-Twisted-19.10.0-150200.3.18.1 as a component of SUSE Linux Enterprise Module for Server Applications 15 SP3 python-Twisted-doc-19.10.0-150200.3.18.1 as a component of openSUSE Leap 15.3 python2-Twisted-19.10.0-150200.3.18.1 as a component of openSUSE Leap 15.3 python3-Twisted-19.10.0-150200.3.18.1 as a component of openSUSE Leap 15.3 Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds. CVE-2022-39348 SUSE Linux Enterprise Module for Package Hub 15 SP3:python3-Twisted-19.10.0-150200.3.18.1 SUSE Linux Enterprise Module for Server Applications 15 SP3:python3-Twisted-19.10.0-150200.3.18.1 openSUSE Leap 15.3:python-Twisted-doc-19.10.0-150200.3.18.1 openSUSE Leap 15.3:python2-Twisted-19.10.0-150200.3.18.1 openSUSE Leap 15.3:python3-Twisted-19.10.0-150200.3.18.1 low To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch". https://www.suse.com/support/update/announcement/2022/suse-su-20224057-1/ https://www.suse.com/security/cve/CVE-2022-39348.html CVE-2022-39348 https://bugzilla.suse.com/1204781 SUSE Bug 1204781