Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 832875 (CVE-2022-21712) - <dev-python/twisted-22.1.0: secret exposure in cross-origin redirects
Summary: <dev-python/twisted-22.1.0: secret exposure in cross-origin redirects
Status: RESOLVED FIXED
Alias: CVE-2022-21712
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal minor
Assignee: Gentoo Security
URL:
Whiteboard: B4 [glsa+]
Keywords:
Depends on: 832903
Blocks:
  Show dependency tree
 
Reported: 2022-02-08 03:57 UTC by John Helmert III
Modified: 2023-01-11 05:25 UTC (History)
2 users (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-08 03:57:07 UTC
CVE-2022-21712 (https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx):

twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.

Please bump to >22.1.
Comment 1 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-02-08 09:43:23 UTC
> Please bump to >22.1.

Easy for you to say :-P.
Comment 2 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-02-09 03:23:59 UTC
Thanks!
Comment 3 Michał Górny archtester Gentoo Infrastructure gentoo-dev Security 2022-02-17 19:40:44 UTC
Cleanup done.
Comment 4 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2022-11-22 16:48:20 UTC
GLSA request filed
Comment 5 Larry the Git Cow gentoo-dev 2023-01-11 05:22:42 UTC
The bug has been referenced in the following commit(s):

https://gitweb.gentoo.org/data/glsa.git/commit/?id=2bcf5e2e8d41a687f63bb2d3acc767b943e61b24

commit 2bcf5e2e8d41a687f63bb2d3acc767b943e61b24
Author:     GLSAMaker <glsamaker@gentoo.org>
AuthorDate: 2023-01-11 05:16:16 +0000
Commit:     John Helmert III <ajak@gentoo.org>
CommitDate: 2023-01-11 05:22:04 +0000

    [ GLSA 202301-02 ] Twisted: Multiple Vulnerabilities
    
    Bug: https://bugs.gentoo.org/832875
    Bug: https://bugs.gentoo.org/834542
    Bug: https://bugs.gentoo.org/878499
    Signed-off-by: GLSAMaker <glsamaker@gentoo.org>
    Signed-off-by: John Helmert III <ajak@gentoo.org>

 glsa-202301-02.xml | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 46 insertions(+)
Comment 6 John Helmert III archtester Gentoo Infrastructure gentoo-dev Security 2023-01-11 05:25:54 UTC
GLSA released, all done!