The remote Redhat Enterprise Linux 7 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2020:1091 advisory.

    Twisted is an event-based framework for internet applications. Twisted Web is a complete web server, aimed     at hosting web applications using Twisted and Python, but fully able to serve static pages too.

    Security Fix(es):

    * python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods (CVE-2019-12387)

    For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and     other related information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    For detailed information on changes in this release, see the Red Hat Enterprise Linux 7.8 Release Notes     linked from the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES12 / SLES_SAP12 host has a package installed that is affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:4074-1 advisory.

    - CVE-2022-39348: Fixed NameVirtualHost Host header injection (bsc#1204781).

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Twisted developers reports :

All HTTP clients in twisted.web.client now raise a ValueError when called with a method and/or URL that contain invalid characters. This mitigates CVE-2019-12387. Thanks to Alex Brasetvik for reporting this vulnerability.

The HTTP/2 server implementation now enforces TCP flow control on control frame messages and times out clients that send invalid data without reading responses. This closes CVE-2019-9512 (Ping Flood), CVE-2019-9514 (Reset Flood), and CVE-2019-9515 (Settings Flood).
Thanks to Jonathan Looney and Piotr Sikora.

twisted.web.http was subject to several request smuggling attacks.
Requests with multiple Content-Length headers were allowed (CVE-2020-10108, thanks to Jake Miller from Bishop Fox and ZeddYu Lu for reporting this) and now fail with a 400; requests with a Content-Length header and a Transfer-Encoding header honored the first header (CVE-2020-10109, thanks to Jake Miller from Bishop Fox for reporting this) and now fail with a 400; requests whose Transfer-Encoding header had a value other than 'chunked' and 'identity' (thanks to ZeddYu Lu) were allowed and now fail with a 400.

* python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods

The remote MiracleLinux 7 host has a package installed that is affected by multiple vulnerabilities as referenced in the AXSA:2020-025:01 advisory.

    * python-twisted: HTTP request smuggling when presented with two Content-Length headers (CVE-2020-10108)
      * python-twisted: HTTP request smuggling when presented with a Content-Length and a chunked Transfer-     Encoding header (CVE-2020-10109)
      * python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods (CVE-2019-12387)

Tenable has extracted the preceding description block directly from the MiracleLinux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Oracle Linux 7 host has a package installed that is affected by a vulnerability as referenced in the ELSA-2020-1091 advisory.

    [12.1.0-6]
    - Fix CVE-2019-12387 (HTTP Header Injection)     Resolves: rhbz#1721518

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	名称	产品	系列	发布时间	最近更新时间	严重程度
135055	RHEL 7 : python-twisted-web (RHSA-2020:1091)	Nessus	Red Hat Local Security Checks	2020/4/1	2024/11/7	medium
167952	SUSE SLES12 Security Update : python-Twisted (SUSE-SU-2022:4074-1)	Nessus	SuSE Local Security Checks	2022/11/19	2026/6/25	critical
135883	FreeBSD : py-twisted -- multiple vulnerabilities (9fbaefb3-837e-11ea-b5b4-641c67a117d8) (Ping Flood) (Reset Flood) (Settings Flood)	Nessus	FreeBSD Local Security Checks	2020/4/22	2024/3/15	critical
135832	Scientific Linux Security Update : python-twisted-web on SL7.x x86_64 (20200407)	Nessus	Scientific Linux Local Security Checks	2020/4/21	2024/3/15	medium
294022	MiracleLinux 7 : python-twisted-web-12.1.0-7.el7 (AXSA:2020-025:01)	Nessus	Miracle Linux Local Security Checks	2026/1/20	2026/1/20	critical
180658	Oracle Linux 7 : python-twisted-web (ELSA-2020-1091)	Nessus	Oracle Linux Local Security Checks	2023/9/7	2024/10/22	medium

检测

插件搜索

medium

critical

critical

medium

critical

medium