CVE-2019-12387

python-twisted: Improper neutralization of CRLF characters in URIs and HTTP methods

Published Jun 10, 2019 CVSS 3.1 · 6.1 Medium EPSS 2.5% KEV · Not listed
Description
In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
EUVD EUVD EUVD-2019-0146 In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.
Github GHSA Github GHSA GHSA-6cc5-2vg4-cc7m Twisted CRLF Injection
Ubuntu USN Ubuntu USN USN-4308-1 Twisted vulnerabilities
Ubuntu USN Ubuntu USN USN-4308-2 Twisted vulnerabilities
History
Type Values Removed Values Added
First Time appeared Twisted
Twisted twisted
CPEs cpe:2.3:a:twistedmatrix:twisted:*:*:*:*:*:*:*:* cpe:2.3:a:twisted:twisted:*:*:*:*:*:*:*:*
Vendors & Products Twistedmatrix
Twistedmatrix twisted
Twisted
Twisted twisted