NetSight
IP …
critical9.8

CVE-2020-10108

Improper Input Validation in Twisted

Impact

In Twisted Web before 20.3.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.

Affected packages

EcosystemPackageAffectedFixed in
pipTwisted< 20.3.020.3.0

Affected products

VendorProductAffected versions
TwistedTwisted
through 19.10.0
FedoraprojectFedora
Versions 31, 32
DebianDebian Linux
Version 9.0
CanonicalUbuntu Linux
Versions 14.04, 16.04, 18.04, 19.10
OracleZfs Storage Appliance Kit
Version 8.8
OracleSolaris
Versions 10, 11

Weakness classification

CWE-444CWE-20

References