Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 832875 (CVE-2022-21712) - <dev-python/twisted-22.1.0: secret exposure in cross-origin redirects
Summary: <dev-python/twisted-22.1.0: secret exposure in cross-origin redirects
Status: CONFIRMED
Alias: CVE-2022-21712
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor (vote)
Assignee: Gentoo Security
URL:
Whiteboard: B4 [glsa?]
Keywords:
Depends on: 832903
Blocks:
  Show dependency tree
 
Reported: 2022-02-08 03:57 UTC by John Helmert III
Modified: 2022-02-17 22:27 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-08 03:57:07 UTC
CVE-2022-21712 (https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx):

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.

Please bump to >22.1.
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-02-08 09:43:23 UTC
> Please bump to >22.1.

Easy for you to say :-P.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-09 03:23:59 UTC
Thanks!
Comment 3 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-02-17 19:40:44 UTC
Cleanup done.