{"answers":{"affected":"2 open source packages ship an affected version, including twisted.","exploited":"There is no known exploitation of GHSA-8r99-h8j2-rw64 in the wild and no public exploit code.","fix":"Upgrade twisted to 20.3.0 or later.","what":"GHSA-8r99-h8j2-rw64 is a vulnerability in twisted, published on 7 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for GHSA-8r99-h8j2-rw64 and fix it if it is affected.\n\nWhat it is: GHSA-8r99-h8j2-rw64 is a vulnerability in twisted, published on 7 Oct 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of GHSA-8r99-h8j2-rw64 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- twisted (PyPI): affected all versions; fixed in 20.3.0\n- twisted (PyPI): affected all versions; fixed in 20.3.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/GHSA-8r99-h8j2-rw64/ (Markdown: https://insights.sbomify.com/GHSA-8r99-h8j2-rw64/index.md)","id":"GHSA-8r99-h8j2-rw64","markdown":"https://insights.sbomify.com/GHSA-8r99-h8j2-rw64/index.md","name":"GHSA-8r99-h8j2-rw64","record":{"aliases":[],"analysis":{"component_type":"library","fix_type":"patch","impacts":["data_read","data_modify"],"network_reachable":"yes","non_default_config":false,"product_category":"Python networking library","requires_auth":"none","summary":"Twisted Web is vulnerable to HTTP request smuggling, allowing attackers to desynchronize request handling and potentially access or modify data.","user_interaction":"not_required","vuln_class":"other"},"analysis_generated_by":"qwen3.8-flash-next","assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"### Impact\nTwisted Web is vulnerable to request smuggling attacks:\n\n1. \"When presented with two content-length headers, Twisted Web ignored the first header. When the second content-length was set to zero this caused Twisted Web to interpret the request body as a pipelined request. According to RFC 7230 Section 3.3.3#4, if a message is received with multiple content-length headers with differing value, then the server must reject the message with a 400 response.\" (Jake Miller of Bishop Fox Security)\n2. \" When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted by Twisted Web as a pipelined request. According to RFC 7230 Section 3.3.3#3, if a message with both content-length and chunked encoding is accepted, transfer-encoding overrides the content-length.\" (Jake Miller of Bishop Fox Security)\n3. ~\"Twisted should not allow BWS between the filed-name and colon.\" (ZeddYu Lu)~ _closed in 9646_\n4. \"Two CL header with different values is also not allowed.\" (ZeddYu Lu)\n5. \"Only accept identity and chunked Transport-Encoding.\" (ZeddYu Lu)\n\n### Patches\nhttps://github.com/twisted/twisted/commit/20c787a14a09e7cbd5dfd8df08ceff00d1fcc081\nhttps://github.com/twisted/twisted/commit/4a7d22e490bb8ff836892cc99a1f54b85ccb0281\n\n### Workarounds\nN/A\n\n### References\nhttps://portswigger.net/web-security/request-smuggling","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":true,"headline":"Twisted vulnerable to HTTP Request Smuggling Attacks","id":"GHSA-8r99-h8j2-rw64","indexable":true,"kev":null,"kind":"advisory","links":{"ecosystem":"PyPI","product":null,"products":[],"type":"other","year":"2022"},"n_packages":2,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":["20.3.0"],"introduced":["0"],"last_affected":[],"package":"twisted","purl":null,"source":"GHSA-8r99-h8j2-rw64"},{"ecosystem":"PyPI","fixed":["20.3.0"],"introduced":["0"],"last_affected":[],"package":"twisted","purl":"pkg:pypi/twisted","source":"GHSA-8r99-h8j2-rw64"}],"products":null,"published":"2022-10-07","related":[],"sources":[{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":"Twisted Web is vulnerable to HTTP request smuggling, allowing attackers to desynchronize request handling and potentially access or modify data.","url":"https://insights.sbomify.com/GHSA-8r99-h8j2-rw64/"}