CVE-2019-12387 Twisted CRLF Injection
Attackers can inject invalid characters like CRLF into URIs or HTTP methods in Twisted web, potentially leading to HTTP response splitting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2019-12387?
CVE-2019-12387 is a medium-severity vulnerability in Canonical Ubuntu Linux, published on 10 Jun 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
Weakness: CWE-74
Which versions are affected by CVE-2019-12387?
3 open source packages ship an affected version, including twisted. It affects 5 products.
| Package | Affected | Fixed in |
|---|---|---|
twisted PyPI | All versions | 19.2.1 |
twisted PyPI | All versions | 19.2.1 |
twisted PyPI | All versions | 19.2.1 |
Linux distribution packages (16)
python-twisted-web Red Hat:enterprise_linux:7::client | All versions | 0:12.1.0-6.el7 |
python-twisted-web Red Hat:enterprise_linux:7::computenode | All versions | 0:12.1.0-6.el7 |
python-twisted-web Red Hat:enterprise_linux:7::server | All versions | 0:12.1.0-6.el7 |
python-twisted-web Red Hat:enterprise_linux:7::workstation | All versions | 0:12.1.0-6.el7 |
python-Twisted SUSE:Enterprise Storage 4 | All versions | 15.2.1-9.5.2 |
python-Twisted SUSE:Enterprise Storage 5 | All versions | 15.2.1-9.5.2 |
python-Twisted SUSE:HPE Helion OpenStack 8 | All versions | 15.2.1-9.5.2 |
python-Twisted SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 15.2.1-9.5.2 |
python-Twisted SUSE:OpenStack Cloud 7 | All versions | 15.2.1-9.5.2 |
python-Twisted SUSE:OpenStack Cloud 8 | All versions | 15.2.1-9.5.2 |
python-Twisted SUSE:OpenStack Cloud 9 | All versions | 15.2.1-9.5.2 |
python-Twisted SUSE:OpenStack Cloud Crowbar 8 | All versions | 15.2.1-9.5.2 |
python-Twisted SUSE:OpenStack Cloud Crowbar 9 | All versions | 15.2.1-9.5.2 |
python-Twisted SUSE:Package Hub 15 | All versions | 17.9.0-bp150.4.3.1 |
python-Twisted openSUSE:Leap 15.0 | All versions | 17.9.0-lp151.3.3.1 |
python-Twisted openSUSE:Leap 15.1 | All versions | 17.9.0-lp151.3.3.1 |
Products include Canonical Ubuntu Linux, Fedoraproject Fedora, Oracle Solaris, Oracle Zfs Storage Appliance Kit, Twisted Twisted.
How do I fix CVE-2019-12387?
Upgrade twisted to 19.2.1 or later.
Is CVE-2019-12387 being exploited?
There is no known exploitation of CVE-2019-12387 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2019-12387, GHSA-6cc5-2vg4-cc7m, PYSEC-2019-128, RHSA-2020:1091, SUSE-SU-2019:1731-1, SUSE-SU-2019:2066-1 and 3 more.