CVE-2022-39348
twisted - security update
Description
Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.
How to fix CVE-2022-39348
To remediate CVE-2022-39348, upgrade the affected package to a fixed version below.
- —upgrade to 20.3.0-7+deb11u2 or later
- —upgrade to 18.9.0-3+deb10u2 or later
- —upgrade to 20.3.0-7+deb11u2 or later
- —upgrade to 22.10.0rc1 or later
Is CVE-2022-39348 being exploited?
Low — EPSS is 1.2%, meaning exploitation activity has not been observed at scale.
Affected packages (4)
- from 0, < 20.3.0-7+deb11u2
- from 0, < 18.9.0-3+deb10u2
- from 0, < 20.3.0-7+deb11u2
- >= 0.9.4, < 22.10.0rc1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N |
| osv | CVSS 3.1 | MEDIUM5.4 | CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |