Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 712240 (CVE-2020-10108, CVE-2020-10109) - <dev-python/twisted-20.3.0: Multiple vulnerabilities (CVE-2020-{10108,10109})
Summary: <dev-python/twisted-20.3.0: Multiple vulnerabilities (CVE-2020-{10108,10109})
Status: RESOLVED FIXED
Alias: CVE-2020-10108, CVE-2020-10109
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL: https://know.bishopfox.com/advisories...
Whiteboard: B3 [glsa+ cve]
Keywords:
Depends on: 722278 726328 773451
Blocks:
  Show dependency tree
 
Reported: 2020-03-12 15:07 UTC by Sam James
Modified: 2021-08-02 17:28 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.
Description Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-12 15:07:15 UTC 
1) CVE-2020-10108

Description:
"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request."

2) CVE-2020-10109

Description:
"In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request."
Comment 2 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-03-30 15:00:03 UTC 
@maintainer(s), please create an appropriate ebuild (patch looks like it's in 20.3.0).
Comment 3 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-04-17 20:12:53 UTC 
@maintainer(s): ping
Comment 4 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-05-06 14:44:15 UTC 
@maintainer(s), please advise if ready for stabilisation, or call yourself
Comment 5 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-06-09 02:29:28 UTC 
@maintainer(s), please cleanup
Comment 6 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-06-18 02:54:28 UTC 
Waiting for PPC stabilisation (it was forgot about).
Comment 7 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-06-22 20:43:17 UTC 
@maintainer(s), please cleanup
Comment 8 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-07-26 05:18:37 UTC 
GLSA vote: yes
Comment 9 GLSAMaker/CVETool Bot gentoo-dev 2020-07-27 00:13:50 UTC 
This issue was resolved and addressed in
 GLSA 202007-24 at https://security.gentoo.org/glsa/202007-24
by GLSA coordinator Sam James (sam_c).
Comment 10 Sam James archtester Gentoo Infrastructure gentoo-dev Security 2020-07-27 01:18:05 UTC 
(In reply to GLSAMaker/CVETool Bot from comment #9)
> This issue was resolved and addressed in
>  GLSA 202007-24 at https://security.gentoo.org/glsa/202007-24
> by GLSA coordinator Sam James (sam_c).

Reopening for cleanup.
Comment 11 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2021-08-02 17:28:24 UTC 
Cleanup done, all done!