NetSight
IP …
high7.5

CVE-2022-21716

Twisted is an event-based framework for internet applications, supporting Python 3.6+.

Impact

Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.

Affected products

VendorProductAffected versions
TwistedTwisted
from 21.7.0 before 22.2.0
DebianDebian Linux
Version 9.0
OracleHttp Server
Versions 12.2.1.3.0, 12.2.1.4.0
OracleZfs Storage Appliance Kit
Version 8.8
FedoraprojectFedora
Versions 35, 36

Weakness classification

CWE-120CWE-770

References