CVE-2023-46137 twisted.web has disordered HTTP pipeline response
Attackers can manipulate HTTP pipeline response ordering to read sensitive data from subsequent requests in the Twisted web framework.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46137?
CVE-2023-46137 is a medium-severity vulnerability in twisted, published on 25 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Twisted is an event-based framework for internet applications. Prior to version 23.10.0rc1, when sending multiple HTTP requests in one TCP packet, twisted.web will process the requests asynchronously without guaranteeing the response order. If one of the endpoints is controlled by an attacker, the attacker can delay the response on purpose to manipulate the response of the second request when a victim launched two requests using HTTP pipeline. Version 23.10.0rc1 contains a patch for this issue.
Weakness: CWE-444
Which versions are affected by CVE-2023-46137?
3 open source packages ship an affected version, including twisted and Twisted. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
twisted PyPI | All versions | 23.10.0rc1 |
twisted PyPI | All versions | 23.10.0rc1 |
Twisted PyPI | All versions | 23.10.0rc1 |
Linux distribution packages (19)
python-twisted Red Hat:openstack:16.1::el8 | All versions | 0:16.4.1-21.el8ost |
python-twisted-debugsource Red Hat:openstack:16.1::el8 | All versions | 0:16.4.1-21.el8ost |
python3-twisted Red Hat:openstack:16.1::el8 | All versions | 0:16.4.1-21.el8ost |
python3-twisted-debuginfo Red Hat:openstack:16.1::el8 | All versions | 0:16.4.1-21.el8ost |
python-twisted Red Hat:openstack:16.2::el8 | All versions | 0:16.4.1-21.el8ost |
python-twisted-debugsource Red Hat:openstack:16.2::el8 | All versions | 0:16.4.1-21.el8ost |
python3-twisted Red Hat:openstack:16.2::el8 | All versions | 0:16.4.1-21.el8ost |
python3-twisted-debuginfo Red Hat:openstack:16.2::el8 | All versions | 0:16.4.1-21.el8ost |
python-Twisted SUSE:Linux Enterprise Module for Public Cloud 15 SP1 | All versions | 17.9.0-150000.3.11.1 |
python-Twisted SUSE:Linux Enterprise Module for Python 3 15 SP4 | All versions | 22.10.0-150400.5.13.1 |
python-Twisted SUSE:Linux Enterprise Module for Python 3 15 SP5 | All versions | 22.10.0-150400.5.13.1 |
python3-Twisted SUSE:Linux Enterprise Module for Server Applications 15 SP4 | All versions | 22.2.0-150400.15.1 |
python3-Twisted SUSE:Linux Enterprise Module for Server Applications 15 SP5 | All versions | 22.2.0-150400.15.1 |
python-Twisted openSUSE:Leap 15.4 | All versions | 19.10.0-150200.3.21.1 |
python-Twisted openSUSE:Leap 15.4 | All versions | 22.10.0-150400.5.13.1 |
python3-Twisted openSUSE:Leap 15.4 | All versions | 22.2.0-150400.15.1 |
python-Twisted openSUSE:Leap 15.5 | All versions | 22.10.0-150400.5.13.1 |
python3-Twisted openSUSE:Leap 15.5 | All versions | 22.2.0-150400.15.1 |
python-Twisted openSUSE:Tumbleweed | All versions | 22.10.0-9.1 |
Products include Twisted Twisted.
How do I fix CVE-2023-46137?
Upgrade twisted to 23.10.0rc1 or later.
Is CVE-2023-46137 being exploited?
There is no known exploitation of CVE-2023-46137 in the wild and no public exploit code.
Other vulnerabilities in twisted
- CVE-2026-42304 Twisted: Denial of Service (DoS) in twisted.names via Crafted DNS Compression Pointer Chains
- CVE-2014-7143 Python Twisted trustRoot is not respected in HTTP client
- CVE-2019-12855 Improper Certificate Validation in Twisted
- CVE-2024-41810 HTML injection in HTTP redirect body
- CVE-2016-1000111 Forced Browsing in Twisted
Sources
Also known as AZL-31788, AZL-35140, DEBIAN-CVE-2023-46137, GHSA-xc8x-vp79-p3wm, OESA-2024-1011, OESA-2024-1012 and 13 more.