DEBIAN-CVE-2022-39348

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/DEBIAN-CVE-2022-39348
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2022-39348.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2022-39348
Upstream
Published
2022-10-26T20:15:10Z
Modified
2025-09-18T03:49:58.744246Z
Summary
[none]
Details

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.

References

Affected packages

Debian:11 / twisted

Package

Name
twisted
Purl
pkg:deb/debian/twisted?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
20.3.0-7+deb11u2

Affected versions

20.*

20.3.0-7
20.3.0-7+deb11u1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / twisted

Package

Name
twisted
Purl
pkg:deb/debian/twisted?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
22.4.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:13 / twisted

Package

Name
twisted
Purl
pkg:deb/debian/twisted?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
22.4.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:14 / twisted

Package

Name
twisted
Purl
pkg:deb/debian/twisted?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
22.4.0-4

Ecosystem specific 

{
    "urgency": "not yet assigned"
}