Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 832875 (CVE-2022-21712)

Summary: <dev-python/twisted-22.1.0: secret exposure in cross-origin redirects
Product: Gentoo Security Reporter: John Helmert III <ajak>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: RESOLVED FIXED    
Severity: minor CC: mgorny, python
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
Whiteboard: B4 [glsa+]
Package list:
Runtime testing required: ---
Bug Depends on: 832903    
Bug Blocks:    

Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-08 03:57:07 UTC
CVE-2022-21712 (https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx):

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.

Please bump to >22.1.
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-02-08 09:43:23 UTC
> Please bump to >22.1.

Easy for you to say :-P.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-09 03:23:59 UTC
Thanks!
Comment 3 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-02-17 19:40:44 UTC
Cleanup done.
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-11-22 16:48:20 UTC
GLSA request filed
Comment 5 Larry the Git Cow gentoo-dev 2023-01-11 05:22:42 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=2bcf5e2e8d41a687f63bb2d3acc767b943e61b24

commit 2bcf5e2e8d41a687f63bb2d3acc767b943e61b24
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-01-11 05:16:16 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2023-01-11 05:22:04 +0000

    [ GLSA 202301-02 ] Twisted: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/832875
    Bug: https://bugs.gentoo.org/834542
    Bug: https://bugs.gentoo.org/878499
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202301-02.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
Comment 6 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-01-11 05:25:54 UTC
GLSA released, all done!