CVE-2020-10109

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.

Link	Resource
https://know.bishopfox.com/advisories/twisted-version-19.10.0	Release Notes Third Party Advisory
https://know.bishopfox.com/advisories	Exploit Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/YW3NIL7VXSGJND2Q4BSXM3CFTAFU6T7D/	Mailing List Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6ISMZFZBWW4EV6ETJGXAYIXN3AT7GBPL/	Mailing List Third Party Advisory
https://usn.ubuntu.com/4308-1/	Third Party Advisory
https://usn.ubuntu.com/4308-2/	Third Party Advisory
https://security.gentoo.org/glsa/202007-24	Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html	Mailing List Third Party Advisory

Configuration 1

cpe:2.3:a:twistedmatrix:twisted:*:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:31:*:*:*:*:*:*:* cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:18.04:*:*:*:lts:*:*:* cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:* cpe:2.3:o:canonical:ubuntu_linux:19.10:*:*:*:*:*:*:* cpe:2.3:o:canonical:ubuntu_linux:16.04:*:*:*:esm:*:*:*

---

Published : 2020-03-12 01:15

Updated : 2022-04-01 02:03

---

NVD link : CVE-2020-10109

Mitre link : CVE-2020-10109

No products.

CWE-444

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')