Description
Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 < /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
twisted twisted
< 22.2.0affected
References
- https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx ↗
- https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9 ↗
- https://github.com/twisted/twisted/releases/tag/twisted-22.2.0 ↗
- https://twistedmatrix.com/trac/ticket/10284 ↗
- https://lists.debian.org/debian-lts-announce/2022/03/msg00009.html ↗
- https://www.oracle.com/security-alerts/cpuapr2022.html ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6/ ↗
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/ ↗
- https://security.gentoo.org/glsa/202301-02 ↗