CVE-2022-21712 (High) detected in Twisted-20.3.0-cp27-cp27mu-manylinux1_x86_64.whl
Opened this issue · 0 comments
CVE-2022-21712 - High Severity Vulnerability
Vulnerable Library - Twisted-20.3.0-cp27-cp27mu-manylinux1_x86_64.whl
An asynchronous networking framework written in Python
Library home page: https://files.pythonhosted.org/packages/4d/15/890ba1d83dc29ad71427ce5174d5963b84a25c8cf1973815107709fbb520/Twisted-20.3.0-cp27-cp27mu-manylinux1_x86_64.whl
Path to dependency file: /tmp/ws-scm/scrapy-cookies
Path to vulnerable library: /tmp/ws-scm/scrapy-cookies
Dependency Hierarchy:
- Scrapy-1.8.0-py2.py3-none-any.whl (Root Library)
- ❌ Twisted-20.3.0-cp27-cp27mu-manylinux1_x86_64.whl (Vulnerable Library)
Found in base branch: master
Vulnerability Details
twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the twited.web.RedirectAgent
and twisted.web. BrowserLikeRedirectAgent
functions. Users are advised to upgrade. There are no known workarounds.
Publish Date: 2022-02-07
URL: CVE-2022-21712
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-92x2-jw7w-xvvx
Release Date: 2022-02-07
Fix Resolution: Twisted - 22.1.0
Step up your Open Source Security Game with Mend here