CVE-2020-10109 (High) detected in Twisted-19.7.0-cp27-cp27mu-manylinux1_x86_64.whl

[mend-for-github-com]

CVE-2020-10109 - High Severity Vulnerability

Vulnerable Library - Twisted-19.7.0-cp27-cp27mu-manylinux1_x86_64.whl

An asynchronous networking framework written in Python

Library home page: https://files.pythonhosted.org/packages/18/0f/0df34ad9161861d5b629a54f5fe8941f1ef9b73425923aeac1861fefa94d/Twisted-19.7.0-cp27-cp27mu-manylinux1_x86_64.whl

Path to dependency file: /tmp/ws-scm/TIBCO-Messaging/eftl-python-sdk/requirements.txt

Path to vulnerable library: ource-ArchiveExtractor_4b226c68-097e-4999-8df2-bd28df1d53e4/20190914000540_32465/20190914000521_depth_0/autobahn-19.9.3-py2.py3-none-any/autobahn/twisted

Dependency Hierarchy:

• ❌ Twisted-19.7.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)

Vulnerability Details

In Twisted Web through 19.10.0, there was an HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request.

Publish Date: 2020-03-12

URL: CVE-2020-10109

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.