{"id":"CVE-2022-21712","aliases":["ALPINE-CVE-2022-21712","AZL-8505","BELL-CVE-2022-21712","CLSA-2025-1762474360","DEBIAN-CVE-2022-21712","DLA-2927-1","EUVD-2022-0346","GHSA-92x2-jw7w-xvvx","MGASA-2022-0168","OESA-2023-1908","OESA-2023-1909","OESA-2023-1970","PYSEC-2022-27","RHSA-2022:0982","RHSA-2022:0992","SUSE-SU-2022:0499-1","SUSE-SU-2022:0734-1","SUSE-SU-2022:4074-1","UBUNTU-CVE-2022-21712","USN-5354-1","openSUSE-SU-2022:0499-1","openSUSE-SU-2024:11841-1"],"status":"published","title":"Cookie and header exposure in twisted","description":"twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.01381,"percentile":0.72364,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-200","CWE-346"],"published":"2022-02-07T00:00:00Z","modified":"2026-11-03T08:01:01Z","fixes":[{"ecosystem":"PyPI","package":"twisted","fixed_in":["22.1.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-twisted","fixed_in":["22.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-twisted","fixed_in":["22.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-twisted","fixed_in":["22.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-twisted","fixed_in":["22.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-twisted","fixed_in":["22.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-twisted","fixed_in":["22.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-twisted","fixed_in":["22.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-twisted","fixed_in":["22.1.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-twisted","fixed_in":["22.1.0-r0"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"python-twisted","fixed_in":["22.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"twisted","fixed_in":["22.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"twisted","fixed_in":["22.1.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"twisted","fixed_in":["22.1.0-1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Twisted","fixed_in":["15.2.1-9.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Twisted","fixed_in":["15.2.1-9.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Twisted","fixed_in":["15.2.1-9.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Twisted","fixed_in":["15.2.1-9.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Twisted","fixed_in":["15.2.1-9.11.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","fixed_in":["15.2.1-9.11.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"twisted","fixed_in":["17.9.0-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"twisted","fixed_in":["18.9.0-11ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"twisted","fixed_in":["22.1.0-2ubuntu2"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-Twisted","fixed_in":["19.10.0-3.6.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"python-Twisted","fixed_in":["22.1.0-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.0"},{"fixed":"22.1.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-r0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-1"}]}]},{"source":"osv","ecosystem":"TuxCare:PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"20.3.0"},{"fixed":"20.3.0.post4+tuxcare"}]}],"versions":["20.3.0"],"bundled":4},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.0-2+deb9u1"}]}],"versions":["16.6.0-2"],"bundled":3},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.1.0"},{"fixed":"22.1.0"}]}],"versions":["11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","20.3.0","20.3.0rc1","21.2.0","21.2.0rc1","21.7.0","21.7.0rc1","21.7.0rc2","21.7.0rc3","22.1.0rc1"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-automat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"python-incremental","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.3.0-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-1.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-1.oe2203"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-1.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"af8fe78542a6f2bf2235ccee8158d9c88d31e8e2"}]},{"type":"ECOSYSTEM","events":[{"introduced":"11.1.0"},{"fixed":"22.1.0"}]}],"versions":["11.1.0","12.0.0","12.1.0","12.2.0","12.3.0","13.0.0","13.1.0","13.2.0","14.0.0","14.0.1","14.0.2","15.0.0","15.1.0","15.2.0","15.2.1","15.3.0","15.4.0","15.5.0","16.0.0","16.1.0","16.1.1","16.2.0","16.3.0","16.3.1","16.3.2","16.4.0","16.4.1","16.5.0","16.5.0rc1","16.5.0rc2","16.6.0","16.6.0rc1","16.7.0rc1","16.7.0rc2","17.1.0","17.1.0rc1","17.5.0","17.9.0","17.9.0rc1","18.4.0","18.4.0rc1","18.7.0","18.7.0rc1","18.7.0rc2","18.9.0","18.9.0rc1","19.10.0","19.10.0rc1","19.2.0","19.2.0rc1","19.2.0rc2","19.2.1","19.7.0","19.7.0rc1","20.3.0","20.3.0rc1","21.2.0","21.2.0rc1","21.7.0","21.7.0rc1","21.7.0rc2","21.7.0rc3","22.1.0rc1"]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-twisted-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-twisted-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-twisted-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-twisted-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Real Time 15 SP2","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.11.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.23.1"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2","13.2.0-1ubuntu1.2+esm1","13.2.0-1ubuntu1.2+esm2","13.2.0-1ubuntu1.2+esm3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2","16.0.0-1ubuntu0.4","16.0.0-1ubuntu0.4+esm1","16.0.0-1ubuntu0.4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.3"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.2"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-2ubuntu2"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.3"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.2"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-3.6.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"twisted","product":"twisted"}],"references":[{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","article","report"]},{"url":"https://github.com/twisted/twisted/commit/af8fe78542a6f2bf2235ccee8158d9c88d31e8e2","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/twisted/twisted/releases/tag/twisted-22.1.0","tags":["x_refsource_MISC","x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/02/msg00021.html","tags":["mailing-list","x_transferred","article","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202301-02","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21712","tags":["web","advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2022-27.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6","tags":["web"]},{"url":"https://pypi.org/project/Twisted","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-92x2-jw7w-xvvx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-21712","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-21712","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21712.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-21712","tags":["advisory"]},{"url":"https://github.com/twisted/twisted","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0168.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30067","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-February/010263.html","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-2927","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/233XDDM6URC3DPBBAKQV2AZQY6TBXJRV/","tags":["web","advisory"]},{"url":"https://www.debian.org/lts/security/2022/dla-2938","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5354-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HJFVJUKPT7GYOWBWGQSIVM3OEHKOEVVJ/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21716","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39348","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1909","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1970","tags":["advisory"]},{"url":"https://pypi.org/project/Twisted/","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0982","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060960","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0982.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21712","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21716","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0992","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0992.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220499-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1195667","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21712","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20220734-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20224074-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1204781","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2019-12387","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-10108","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-39348","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-21712","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2022-21716","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2022-21712","title":"Cookie and header exposure in twisted","description":"twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.","status":"published","published":"2022-02-07T00:00:00Z","modified":"2025-04-23T19:07:10.732Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:34:28.707644Z"}],"euvd":[{"id":"EUVD-2022-0346","description":"twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.","status":"published","published":"2022-02-07T00:00:00Z","modified":"2025-04-23T19:07:10Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T20:52:06.891582Z"}],"ghsa":[{"id":"GHSA-92x2-jw7w-xvvx","title":"Cookie and header exposure in twisted","description":"### Impact\n\nCookie and Authorization headers are leaked when following cross-origin redirects in `twited.web.client.RedirectAgent` and `twisted.web.client.BrowserLikeRedirectAgent`.","status":"published","published":"2022-02-07T22:36:00Z","modified":"2024-11-25T18:33:22Z","cvss":[{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200","CWE-346"],"updated_at":"2026-11-02T14:38:23.575854Z"}],"nvd":[{"id":"CVE-2022-21712","description":"twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.","status":"published","published":"2022-02-07T22:15:08.587Z","modified":"2026-06-17T04:26:49.11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200","CWE-346"],"updated_at":"2026-11-02T14:07:11.52734Z"}],"osv":[{"id":"ALPINE-CVE-2022-21712","description":"twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.","status":"published","published":"2022-02-07T22:15:08.587Z","modified":"2026-11-03T07:30:18.712464097Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"AZL-8505","title":"CVE-2022-21712 affecting package python-twisted for versions less than 22.2.0-1","description":"twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.","status":"published","published":"2022-02-07T22:15:08Z","modified":"2026-04-21T04:34:51.514265Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:10.335477Z"},{"id":"BELL-CVE-2022-21712","title":"CVE-2022-21712 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:14:17.12372Z","modified":"2026-01-26T09:45:55.90759Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2022-21712","title":"Cookie and header exposure in twisted","description":"twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.","status":"published","published":"2022-02-07T00:00:00Z","modified":"2026-10-28T02:30:51.948600408Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"DEBIAN-CVE-2022-21712","description":"twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.","status":"published","published":"2022-02-07T22:15:08.587Z","modified":"2026-11-03T08:01:01.52758066Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"GHSA-92x2-jw7w-xvvx","title":"Cookie and header exposure in twisted","description":"### Impact\n\nCookie and Authorization headers are leaked when following cross-origin redirects in `twited.web.client.RedirectAgent` and `twisted.web.client.BrowserLikeRedirectAgent`.","status":"published","published":"2022-02-07T22:36:00Z","modified":"2024-11-25T18:48:47.216319Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-200","CWE-346"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"OESA-2023-1908","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\ntwisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.(CVE-2022-21712)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer\u0026apos;s SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u0026lt; /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.(CVE-2022-21716)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web\u0026apos;s HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.(CVE-2022-24801)\r\n\r\nTwisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.(CVE-2022-39348)","status":"published","published":"2023-12-15T11:06:21Z","modified":"2026-08-18T01:18:05.460961379Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1909","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\ntwisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.(CVE-2022-21712)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer\u0026apos;s SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u0026lt; /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.(CVE-2022-21716)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web\u0026apos;s HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.(CVE-2022-24801)\r\n\r\nTwisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.(CVE-2022-39348)","status":"published","published":"2023-12-15T11:06:21Z","modified":"2026-08-18T01:18:05.391470179Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1970","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\ntwisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.(CVE-2022-21712)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer\u0026apos;s SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u0026lt; /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.(CVE-2022-21716)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web\u0026apos;s HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.(CVE-2022-24801)\r\n\r\nTwisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.(CVE-2022-39348)","status":"published","published":"2023-12-22T11:06:25Z","modified":"2026-08-18T01:18:07.506247215Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2022:0982","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (python-twisted) security update","status":"published","published":"2024-09-18T05:55:21Z","modified":"2025-11-22T12:31:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0992","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-twisted) security update","status":"published","published":"2024-09-18T05:55:12Z","modified":"2025-11-22T12:31:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"UBUNTU-CVE-2022-21712","description":"twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.","status":"published","published":"2022-02-07T22:15:00Z","modified":"2026-02-04T03:44:08.008772Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"CLSA-2025-1762474360","title":"TuxCare security update for twisted (4 CVEs)","description":"TuxCare rebuilt twisted to address 4 CVEs. Fixed in 20.3.0.post4+tuxcare.","status":"published","published":"2026-08-04T14:52:09Z","modified":"2026-10-15T09:48:00.955124071Z","updated_at":"2026-11-02T15:43:42.427288Z"},{"id":"DLA-2927-1","title":"twisted - security update","status":"published","published":"2022-02-19T00:00:00Z","modified":"2026-03-09T01:21:21.652203Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0168","title":"Updated python-twisted packages fix security vulnerability","description":"CVE-2022-21712: It was discovered that Twisted incorrectly filtered HTTP\nheaders when clients are being redirected to another origin. A remote\nattacker could use this issue to obtain sensitive information.\nCVE-2022-21716: It was discovered that Twisted incorrectly processed SSH\nhandshake data on connection establishments. A remote attacker could use\nthis issue to cause Twisted to crash, resulting in a denial of service.\n\nGHSA-rv6r-3f5q-9rgx\nThe Twisted SSH client and server implementation naively accepted an\ninfinite amount of data for the peer's SSH version identifier.\n\nGHSA-c2jg-hw38-jrqq and CVE-2022-24801\nThe Twisted Web HTTP 1.1 server, located in the twisted.web.http module,\nparsed several HTTP request constructs more leniently than permitted by\nRFC 7230\n\nGHSA-92x2-jw7w-xvvx: twisted.web.client.getPage,\ntwisted.web.client.downladPage, and the associated implementation classes\n(HTTPPageGetter, HTTPPageDownloader, HTTPClientFactory, HTTPDownloader)\nhave been removed because they do not segregate cookies by domain. They\nwere deprecated in Twisted 16.7.0 in favor of twisted.web.client.Agent.\n","status":"published","published":"2022-05-12T10:24:45Z","modified":"2026-04-16T04:40:45.962036274Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2022:0499-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2022-21712: Fixed secret exposure in cross-origin redirects by\n  properly removing sensitive headers when redirecting to a different origin\n  (bsc#1195667).\n","status":"published","published":"2022-02-18T09:50:32Z","modified":"2026-02-04T03:01:34.300416Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:11841-1","title":"python-Twisted-doc-22.1.0-1.1 on GA media","description":"These are all security issues fixed in the python-Twisted-doc-22.1.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:33:13.766931Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"PYSEC-2022-27","description":"twisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.","status":"published","published":"2022-02-07T22:15:00Z","modified":"2023-11-08T04:08:09.047388Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"SUSE-SU-2022:0499-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2022-21712: Fixed secret exposure in cross-origin redirects by\n  properly removing sensitive headers when redirecting to a different origin\n  (bsc#1195667).\n","status":"published","published":"2022-02-18T09:51:05Z","modified":"2026-02-04T03:45:46.764299Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:0734-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2022-21712: Fixed secret exposure in cross-origin redirects (bsc#1195667, GHSA-92x2-jw7w-xvvx) from\n","status":"published","published":"2022-03-04T13:48:53Z","modified":"2026-02-04T03:26:21.164027Z","updated_at":"2026-11-02T15:53:50.066806Z"},{"id":"SUSE-SU-2022:4074-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2022-39348: Fixed NameVirtualHost Host header injection (bsc#1204781).\n","status":"published","published":"2022-11-18T12:54:53Z","modified":"2026-02-04T04:11:13.441398Z","updated_at":"2026-11-02T15:53:51.440565Z"},{"id":"USN-5354-1","title":"twisted vulnerabilities","description":"It was discovered that Twisted incorrectly filtered HTTP headers when clients \nare being redirected to another origin. A remote attacker could use this issue \nto obtain sensitive information. (CVE-2022-21712)\n\nIt was discovered that Twisted incorrectly processed SSH handshake data on \nconnection establishments. A remote attacker could use this issue to cause \nTwisted to crash, resulting in a denial of service. (CVE-2022-21716)\n","status":"published","published":"2022-03-30T08:17:48Z","modified":"2026-04-27T16:19:03.000417607Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}