In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request.
{ "ubuntu_priority": "medium", "availability": "Available with Ubuntu Pro (Infra-only): https://ubuntu.com/pro", "binaries": [ { "binary_name": "python-twisted", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-bin", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-bin-dbg", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-bin-dbgsym", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-conch", "binary_version": "1:13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-core", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-lore", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-mail", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-names", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-news", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-runner", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-runner-dbg", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-runner-dbgsym", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-web", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "python-twisted-words", "binary_version": "13.2.0-1ubuntu1.2+esm1" }, { "binary_name": "twisted-doc", "binary_version": "13.2.0-1ubuntu1.2+esm1" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "python-twisted", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-bin", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-bin-dbg", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-conch", "binary_version": "1:16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-core", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-mail", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-names", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-news", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-runner", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-runner-dbg", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-web", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python-twisted-words", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "python3-twisted", "binary_version": "16.0.0-1ubuntu0.4" }, { "binary_name": "twisted-doc", "binary_version": "16.0.0-1ubuntu0.4" } ] }
{ "ubuntu_priority": "medium", "availability": "No subscription required", "binaries": [ { "binary_name": "python-twisted", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-bin", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-bin-dbg", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-conch", "binary_version": "1:17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-core", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-mail", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-names", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-news", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-runner", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-runner-dbg", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-web", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python-twisted-words", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python3-twisted", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python3-twisted-bin", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "python3-twisted-bin-dbg", "binary_version": "17.9.0-2ubuntu0.1" }, { "binary_name": "twisted-doc", "binary_version": "17.9.0-2ubuntu0.1" } ] }