CVE-2022-21716
Description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peers SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as nc -rv localhost 22 < /dev/zero. A patch is available in version 22.2.0. There are currently no known workarounds.
Risk Information
Base Score
7.5
MODERATE
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score
Exploitation Probability
0.968
Associated Vulnerability
| Vulnerability | OS Platform |
|---|---|
| Vulnerabilities CVE-2022-21716 are fixed in Python-twisted 22.2.0 | Windows |
| Event-based framework for internet applications (USN-5354-1) python-twisted_17.9.0-2ubuntu0.3_all.deb | Linux |
| Event-based framework for internet applications (USN-5354-1) python3-twisted_17.9.0-2ubuntu0.3_all.deb | Linux |
| Event-based framework for internet applications (USN-5354-1) python3-twisted_20.3.0-7ubuntu1.1_all.deb | Linux |
| Event-based framework for internet applications (USN-5354-1) python3-twisted_18.9.0-11ubuntu0.20.04.2_all.deb | Linux |
| Event-based framework for internet applications (USN-5354-1) python-twisted-bin_17.9.0-2ubuntu0.3_i386.deb | Linux |
| Event-based framework for internet applications (USN-5354-1) python-twisted-bin_17.9.0-2ubuntu0.3_amd64.deb | Linux |
| Event-based framework for internet applications (USN-5354-1) python3-twisted-bin_17.9.0-2ubuntu0.3_i386.deb | Linux |
| Event-based framework for internet applications (USN-5354-1) python3-twisted-bin_17.9.0-2ubuntu0.3_amd64.deb | Linux |
| Event-based framework for internet applications (USN-5354-1) python3-twisted-bin_20.3.0-7ubuntu1.1_amd64.deb | Linux |
| Event-based framework for internet applications (USN-5354-1) python3-twisted-bin_18.9.0-11ubuntu0.20.04.2_amd64.deb | Linux |
| Event-based framework for internet applications (USN-5354-2) python-twisted_13.2.0-1ubuntu1.2_all.deb | Linux |
| Event-based framework for internet applications (USN-5354-2) python-twisted_16.0.0-1ubuntu0.4_all.deb | Linux |
| Event-based framework for internet applications (USN-5354-2) python3-twisted_22.1.0-2ubuntu2.3_all.deb | Linux |
| Event-based framework for internet applications (USN-5354-2) python3-twisted_16.0.0-1ubuntu0.4_all.deb | Linux |
| Event-based framework for internet applications (USN-5354-2) python-twisted-bin_13.2.0-1ubuntu1.2_i386.deb | Linux |
| Event-based framework for internet applications (USN-5354-2) python-twisted-bin_13.2.0-1ubuntu1.2_amd64.deb | Linux |
| Event-based framework for internet applications (USN-5354-2) python-twisted-bin_16.0.0-1ubuntu0.4_i386.deb | Linux |
| Event-based framework for internet applications (USN-5354-2) python-twisted-bin_16.0.0-1ubuntu0.4_amd64.deb | Linux |
| Event-based framework for internet applications (USN-5354-2) python-twisted-web_13.2.0-1ubuntu1.2_all.deb | Linux |
| Event-based framework for internet applications (USN-5354-2) python-twisted-web_16.0.0-1ubuntu0.4_all.deb | Linux |
| python-twisted Security Update (ALAS2023-2023-056) python3-twisted-22.4.0-124.amzn2023.0.2.noarch.rpm | Linux |
| python-twisted Security Update (ALAS2023-2023-056) python3-twisted+tls-22.4.0-124.amzn2023.0.2.noarch.rpm | Linux |
| Vulnerabilities CVE-2022-21716 are fixed in Python-twisted for linux 22.2.0 | Linux |
Patch Details
No records foundReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234