OESA-2023-1911

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2023-1911
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2023-1911.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2023-1911
Upstream
Published
2023-12-15T11:06:28Z
Modified
2025-08-12T05:14:51.271564Z
Summary
python-twisted security update
Details

Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:

Security Fix(es):

Twisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host twisted.web.vhost.NameVirtualHost will return a NoResource resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.(CVE-2022-39348)

Database specific 
{
    "severity": "Medium"
}
References

Affected packages

openEuler:22.03-LTS-SP2 / python-twisted

Package

Name
python-twisted
Purl
pkg:rpm/openEuler/python-twisted&distro=openEuler-22.03-LTS-SP2

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
22.4.0-2.oe2203sp2

Ecosystem specific 

{
    "src": [
        "python-twisted-22.4.0-2.oe2203sp2.src.rpm"
    ],
    "x86_64": [
        "python3-twisted-22.4.0-2.oe2203sp2.x86_64.rpm"
    ],
    "aarch64": [
        "python3-twisted-22.4.0-2.oe2203sp2.aarch64.rpm"
    ],
    "noarch": [
        "python-twisted-help-22.4.0-2.oe2203sp2.noarch.rpm"
    ]
}