GHSA-32gv-6cf3-wcmq HTTP/2 DoS Attacks: Ping, Reset, and Settings Floods
Remote attackers can cause denial of service in Twisted web servers with optional HTTP/2 support via ping, reset, or settings floods.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-32gv-6cf3-wcmq?
GHSA-32gv-6cf3-wcmq is a denial of service vulnerability in twisted, published on 14 Mar 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Impact
Twisted web servers that utilize the optional HTTP/2 support suffer from the following flow-control related vulnerabilities:
Ping flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512 Reset flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514 Settings flood: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9515
A Twisted web server supports HTTP/2 requests if you've installed the http2 optional dependency set.
Workarounds
There are no workarounds.
References
https://github.com/Netflix/security-bulletins/blob/master/advisories/third-party/2019-002.md
For more information
If you have any questions or comments about this advisory:
- Open an issue in Twisted's Trac
Which versions are affected by GHSA-32gv-6cf3-wcmq?
2 open source packages ship an affected version, including twisted.
| Package | Affected | Fixed in |
|---|---|---|
twisted PyPI | All versions | 19.10.0 |
twisted PyPI | All versions | 19.10.0 |
How do I fix GHSA-32gv-6cf3-wcmq?
Upgrade twisted to 19.10.0 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is GHSA-32gv-6cf3-wcmq being exploited?
There is no known exploitation of GHSA-32gv-6cf3-wcmq in the wild and no public exploit code.