Vulnerability Description
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
CVSS Score
6.1
MEDIUM
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Twisted | Twisted | < 19.2.1 |
| Fedoraproject | Fedora | 29 |
| Canonical | Ubuntu Linux | 14.04 |
| Oracle | Zfs Storage Appliance Kit | 8.8 |
| Oracle | Solaris | 11 |
Related Weaknesses (CWE)
References
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.htmlBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.htmlBroken Link
- https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7PatchThird Party Advisory
- https://labs.twistedmatrix.com/2019/06/twisted-1921-released.htmlExploitRelease NotesVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.htmlExploitRelease NotesVendor Advisory
- https://usn.ubuntu.com/4308-1/Third Party Advisory
- https://usn.ubuntu.com/4308-2/Third Party Advisory
- https://www.oracle.com/security-alerts/cpuapr2020.htmlPatchThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.htmlBroken Link
- http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.htmlBroken Link
- https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7PatchThird Party Advisory
- https://labs.twistedmatrix.com/2019/06/twisted-1921-released.htmlExploitRelease NotesVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.htmlExploitRelease NotesVendor Advisory
FAQ
What is CVE-2019-12387?
CVE-2019-12387 is a vulnerability with a CVSS score of 6.1 (MEDIUM). In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
How severe is CVE-2019-12387?
CVE-2019-12387 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-12387?
Check the references section above for vendor advisories and patch information. Affected products include: Twisted Twisted, Fedoraproject Fedora, Canonical Ubuntu Linux, Oracle Zfs Storage Appliance Kit, Oracle Solaris.