-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA512 Format: 1.8 Date: Sat, 19 Feb 2022 16:03:45 +0100 Source: twisted Binary: python3-twisted python3-twisted-bin python3-twisted-bin-dbg python-twisted-bin python-twisted-bin-dbg python-twisted-core python-twisted-conch python-twisted-mail python-twisted-names python-twisted-news python-twisted-runner python-twisted-runner-dbg python-twisted-web python-twisted-words twisted-doc python-twisted Architecture: source Version: 16.6.0-2+deb9u1 Distribution: stretch-security Urgency: high Maintainer: Debian Python Modules Team <python-modules-team@lists.alioth.debian.org> Changed-By: Sylvain Beucler <beuc@debian.org> Description: python-twisted - Event-based framework for internet applications (dependency packa python-twisted-bin - Event-based framework for internet applications python-twisted-bin-dbg - Event-based framework for internet applications (debug extension) python-twisted-conch - twisted dummy package for Twisted SSH Implementation python-twisted-core - Event-based framework for internet applications python-twisted-mail - twisted dummy package for SMTP, IMAP and POP protocol implementat python-twisted-names - twisted package for DNS protocol implementation python-twisted-news - twisted dummy package for NNTP protocol implementation python-twisted-runner - twisted dummy package for process management python-twisted-runner-dbg - twisted dummy package for process management python-twisted-web - twisted dummy package for HTTP protocol implementation python-twisted-words - twisted dummy package for Chat and Instant Messaging python3-twisted - Event-based framework for internet applications python3-twisted-bin - Event-based framework for internet applications python3-twisted-bin-dbg - Event-based framework for internet applications (debug extension) twisted-doc - Official documentation of Twisted Changes: twisted (16.6.0-2+deb9u1) stretch-security; urgency=high . * Non-maintainer upload by the LTS Security Team. * CVE-2020-10108: HTTP request splitting vulnerability. When presented with two content-length headers, it ignored the first header. When the second content-length value was set to zero, the request body was interpreted as a pipelined request. * CVE-2020-10109: HTTP request splitting vulnerability. When presented with a content-length and a chunked encoding header, the content-length took precedence and the remainder of the request body was interpreted as a pipelined request. * CVE-2022-21712: twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twisted.web.RedirectAgent` and `twisted.web.BrowserLikeRedirectAgent` functions. Checksums-Sha1: 74149a2826deda7854e08d352e53237e8b1ac2ad 3461 twisted_16.6.0-2+deb9u1.dsc 57ea06c54e59c314f904870946c4a3586d7b86ea 2979747 twisted_16.6.0.orig.tar.bz2 e5b848d5833582187c5360e1af65538778e57692 29516 twisted_16.6.0-2+deb9u1.debian.tar.xz 2e60c16be5c7d78945197ef4072d8eac7f7807ad 9094 twisted_16.6.0-2+deb9u1_amd64.buildinfo Checksums-Sha256: 9c5bdfaaee5de27bc30088f79b9c5bb5b2bd8f36971300c3c5bd012b10c9c9f4 3461 twisted_16.6.0-2+deb9u1.dsc d0fe115ea7ef8cf632d05103de60356c6e992b2153d6830bdc4476f8accb1fca 2979747 twisted_16.6.0.orig.tar.bz2 e950eba08e985dc8fe4a8468aa8b42ecf9efbf87f595d8238abaef8734cf5ca7 29516 twisted_16.6.0-2+deb9u1.debian.tar.xz e54e2a7013a3930b5bf9dc155dcef5704eeb6eaf41461b433332a80b9b9f8e7b 9094 twisted_16.6.0-2+deb9u1_amd64.buildinfo Files: b72cfa45744bc09fb5b576d6769343d1 3461 python optional twisted_16.6.0-2+deb9u1.dsc 54a88ffe773d5a83c91fcfe86044b094 2979747 python optional twisted_16.6.0.orig.tar.bz2 ab4ffcccca80b9a0df4a2ee6aef2b231 29516 python optional twisted_16.6.0-2+deb9u1.debian.tar.xz ae8af3222313ed3fb9d567dc45346a6c 9094 python optional twisted_16.6.0-2+deb9u1_amd64.buildinfo -----BEGIN PGP SIGNATURE----- iQIzBAEBCgAdFiEE1vEOfV7HXWKqBieIDTl9HeUlXjAFAmIRE14ACgkQDTl9HeUl XjAANw/+Mu1j5M+KDNnF8H0oCbAl3IaICw94kKEv1GVbi+Ku4pebu33RNAVo+4TI ECm3hIWpSx/teyLb93h3DwKLCRL90FOfP3ckKWXKkmkTCGIdIYEZq20lTT0C+K2/ wQP1Ij6o4Jhn/eyrPd9Gr10n1u//h7n/2gOoH9pBtIoorscbwxR30YWMrJOU6niP t5QLRwCVZK6cd4LIpsqWxW7KoxdC7ztSSmqLPhxs4lZulmiuVq1KFuEyoyvsczNH wJKpFupAjVO5MqT4y2Zxq3xrpH0NCjjedw/8atZUNy1ScneaioaPpUIWvP0Jua3M AK1oTu1XQOW0Vhs2FeyU9qgqevDf0RKIewHWV3PtQQi5fu2LZSDQwsl7gTMdSV37 CrvZZPaOhXlWaF4tGSdECdqkTSzIL8YtZX9lJQ5OvPpT0LgYOPnLZg2rfXWB8Ep6 qcY0ZOUVTrpMuwsl1HThlAx36/5HmqEinYPc5au2g1bq1p4y+XThW7IbgXhHGgVs PhOvwLupvEgzBDpIAlQC0j9EVBcla2v90X6/ipOKtmOuC3WqHk/cOyEm1EUTqtpa b0vIvi1blU4FcgYmEJ21UXqiU975Fh3GSvcfZyvJiyvYARaIwkDlI/3Z1nfaTwFp kW8gH1rlEXX5zaTXWQ+QzbWHrZ8lc3zv3/gN7DERW6ipuLdZ25k= =KrFS -----END PGP SIGNATURE-----
