Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.
The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer, leading to a buffer overflow.
The product allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
| Link | Tags |
|---|---|
| https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx | patch third party advisory exploit |
| https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9 | third party advisory patch |
| https://github.com/twisted/twisted/releases/tag/twisted-22.2.0 | third party advisory release notes |
| https://twistedmatrix.com/trac/ticket/10284 | vendor advisory issue tracking |
| https://lists.debian.org/debian-lts-announce/2022/03/msg00009.html | third party advisory mailing list |
| https://www.oracle.com/security-alerts/cpuapr2022.html | third party advisory patch |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6/ | vendor advisory |
| https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/ | vendor advisory |
| https://security.gentoo.org/glsa/202301-02 | third party advisory vendor advisory |