CVE-2022-21712 Cookie and header exposure in twisted
Attackers can steal cookies and authorization headers when the Twisted library follows cross-origin redirects, potentially leading to session hijacking.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-21712?
CVE-2022-21712 is a high-severity vulnerability in Debian Debian Linux, published on 7 Feb 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.
Which versions are affected by CVE-2022-21712?
3 open source packages ship an affected version, including twisted and Twisted. It affects 3 products.
| Package | Affected | Fixed in |
|---|---|---|
twisted PyPI | From 11.1.0 | 22.1.0 |
twisted PyPI | From 11.1.0 | 22.1.0 |
Twisted PyPI | From 11.1.0 | 22.1.0 |
Linux distribution packages (20)
python-Twisted SUSE:Enterprise Storage 7 | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:HPE Helion OpenStack 8 | All versions | 15.2.1-9.11.1 |
python-Twisted SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:Linux Enterprise Module for Package Hub 15 SP3 | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:Linux Enterprise Module for Server Applications 15 SP3 | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:Linux Enterprise Module for Web and Scripting 12 | All versions | 15.2.1-9.11.1 |
python-Twisted SUSE:Linux Enterprise Real Time 15 SP2 | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:Linux Enterprise Server 15 SP2-BCL | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:Linux Enterprise Server 15 SP2-LTSS | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:Linux Enterprise Server for SAP Applications 15 SP2 | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:Manager Proxy 4.1 | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:Manager Retail Branch Server 4.1 | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:Manager Server 4.1 | All versions | 19.10.0-3.6.1 |
python-Twisted SUSE:OpenStack Cloud 8 | All versions | 15.2.1-9.11.1 |
python-Twisted SUSE:OpenStack Cloud 9 | All versions | 15.2.1-9.11.1 |
python-Twisted SUSE:OpenStack Cloud Crowbar 8 | All versions | 15.2.1-9.11.1 |
python-Twisted SUSE:OpenStack Cloud Crowbar 9 | All versions | 15.2.1-9.11.1 |
python-Twisted openSUSE:Leap 15.3 | All versions | 19.10.0-3.6.1 |
python-Twisted openSUSE:Tumbleweed | All versions | 22.1.0-1.1 |
Products include Debian Debian Linux, Fedoraproject Fedora, Twisted Twisted.
How do I fix CVE-2022-21712?
Upgrade twisted to 22.1.0 or later.
Is CVE-2022-21712 being exploited?
There is no known exploitation of CVE-2022-21712 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as AZL-8505, DEBIAN-CVE-2022-21712, GHSA-92x2-jw7w-xvvx, PYSEC-2022-27, SUSE-SU-2022:0499-1, SUSE-SU-2022:0734-1 and 3 more.