{"id":"CVE-2022-21716","aliases":["ALPINE-CVE-2022-21716","BELL-CVE-2022-21716","DEBIAN-CVE-2022-21716","DLA-2938-1","EUVD-2022-0344","GHSA-rv6r-3f5q-9rgx","MGASA-2022-0168","OESA-2023-1908","OESA-2023-1909","OESA-2023-1970","PYSEC-2022-160","RHSA-2022:0982","RHSA-2022:0992","SUSE-SU-2022:2070-1","SUSE-SU-2022:2117-1","SUSE-SU-2022:2297-1","UBUNTU-CVE-2022-21716","USN-5354-1","USN-5354-2","openSUSE-SU-2024:11978-1"],"status":"published","title":"Buffer Overflow in Twisted","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u003c /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0351,"percentile":0.89286,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-120","CWE-770"],"published":"2022-03-03T00:00:00Z","modified":"2026-11-03T07:30:18Z","fixes":[{"ecosystem":"PyPI","package":"twisted","fixed_in":["22.2.0"],"sources":["ghsa","osv"]},{"ecosystem":"Alpine:v3.16","package":"py3-twisted","fixed_in":["22.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.17","package":"py3-twisted","fixed_in":["22.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.18","package":"py3-twisted","fixed_in":["22.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.19","package":"py3-twisted","fixed_in":["22.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.20","package":"py3-twisted","fixed_in":["22.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.21","package":"py3-twisted","fixed_in":["22.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.22","package":"py3-twisted","fixed_in":["22.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.23","package":"py3-twisted","fixed_in":["22.2.0-r0"],"sources":["osv"]},{"ecosystem":"Alpine:v3.24","package":"py3-twisted","fixed_in":["22.2.0-r0"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"twisted","fixed_in":["22.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"twisted","fixed_in":["22.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"twisted","fixed_in":["22.2.0-1"],"sources":["osv"]},{"ecosystem":"Debian:9","package":"twisted","fixed_in":["16.6.0-2+deb9u2"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.1","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.1","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.3","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.4","package":"python-Twisted","fixed_in":["19.10.0-150200.3.12.1","22.2.0-150400.5.4.1"],"sources":["osv"]},{"ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Twisted","fixed_in":["15.2.1-9.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Twisted","fixed_in":["15.2.1-9.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Twisted","fixed_in":["15.2.1-9.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Twisted","fixed_in":["15.2.1-9.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Twisted","fixed_in":["15.2.1-9.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","fixed_in":["15.2.1-9.17.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"python-Twisted","fixed_in":["22.2.0-150400.5.4.1"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","fixed_in":["13.2.0-1ubuntu1.2+esm2"],"sources":["osv"]},{"ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twisted","fixed_in":["16.0.0-1ubuntu0.4+esm1"],"sources":["osv"]},{"ecosystem":"Ubuntu:18.04:LTS","package":"twisted","fixed_in":["17.9.0-2ubuntu0.3"],"sources":["osv"]},{"ecosystem":"Ubuntu:20.04:LTS","package":"twisted","fixed_in":["18.9.0-11ubuntu0.20.04.2"],"sources":["osv"]},{"ecosystem":"Ubuntu:22.04:LTS","package":"twisted","fixed_in":["22.1.0-2ubuntu2.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.7.0"},{"fixed":"22.2.0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.16","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.17","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.18","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.19","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.20","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.21","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.22","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.23","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-r0"}]}]},{"source":"osv","ecosystem":"Alpine:v3.24","package":"py3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-r0"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-1"}]}]},{"source":"osv","ecosystem":"Debian:9","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.6.0-2+deb9u2"}]}],"versions":["16.6.0-2","16.6.0-2+deb9u1"]},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"21.7.0"},{"fixed":"22.2.0"}]}],"versions":["21.7.0","22.1.0","22.1.0rc1","22.2.0rc1"]},{"source":"osv","ecosystem":"Mageia:8","package":"python-automat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.8.0-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"python-incremental","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.3.0-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"Mageia:8","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-1.mga8"}]}],"bundled":2},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-1.oe1"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-1.oe2203"}]}],"bundled":4},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP4","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.4.0-1.oe2003sp4"}]}],"bundled":4},{"source":"osv","ecosystem":"PyPI","package":"twisted","ranges":[{"type":"GIT","events":[{"introduced":"0"},{"fixed":"89c395ee794e85a9657b112c4351417850330ef9"}]},{"type":"ECOSYSTEM","events":[{"introduced":"21.7.0"},{"fixed":"22.2.0"}]}],"versions":["21.7.0","22.1.0","22.1.0rc1","22.2.0rc1"]},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python-twisted-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.1::el8","package":"python3-twisted-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python-twisted-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:openstack:16.2::el8","package":"python3-twisted-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:16.4.1-19.el8ost"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP3","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP3","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-ESPOS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-BCL","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.1","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Retail Branch Server 4.1","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.1","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.3","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"19.10.0-150200.3.12.1"}]}]},{"source":"osv","ecosystem":"SUSE:HPE Helion OpenStack 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 8","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud Crowbar 9","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Web and Scripting 12","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"15.2.1-9.17.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.5.4.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.4","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-150400.5.4.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-1ubuntu1.2+esm2"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2","13.2.0-1ubuntu1.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.0-1ubuntu0.4+esm1"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2","16.0.0-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.3"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.2"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-2ubuntu2.1"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3","22.1.0-2ubuntu2"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"17.9.0-2ubuntu0.3"}]}],"versions":["16.6.0-2ubuntu3","17.9.0-1","17.9.0-2","17.9.0-2ubuntu0.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"18.9.0-11ubuntu0.20.04.2"}]}],"versions":["18.9.0-3ubuntu1","18.9.0-5","18.9.0-6","18.9.0-6build1","18.9.0-6ubuntu1","18.9.0-8","18.9.0-11","18.9.0-11ubuntu0.20.04.1"],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:Pro:14.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.2.0-1ubuntu1.2+esm2"}]}],"versions":["13.0.0-1ubuntu1","13.2.0-1ubuntu1","13.2.0-1ubuntu1.2","13.2.0-1ubuntu1.2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"16.0.0-1ubuntu0.4+esm1"}]}],"versions":["15.2.1-1ubuntu2","15.5.0-1","15.5.0-2","15.5.0-2ubuntu1","15.5.0-4","16.0.0~pre1-1","16.0.0~pre1-1ubuntu1","16.0.0~pre1-2ubuntu1","16.0.0~pre1-3","16.0.0-1","16.0.0-1ubuntu0.2","16.0.0-1ubuntu0.4"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.1.0-2ubuntu2.1"}]}],"versions":["20.3.0-7ubuntu1","20.3.0-7ubuntu3","22.1.0-2ubuntu2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"python-Twisted","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"22.2.0-1.1"}]}],"bundled":2}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"oracle","product":"http_server"},{"vendor":"oracle","product":"zfs_storage_appliance_kit"},{"vendor":"twisted","product":"twisted"}],"references":[{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx","tags":["x_transferred","Exploit","Patch","Third Party Advisory","advisory","web","report"]},{"url":"https://github.com/twisted/twisted/commit/89c395ee794e85a9657b112c4351417850330ef9","tags":["x_transferred","Patch","Third Party Advisory","fix","web","report"]},{"url":"https://github.com/twisted/twisted/releases/tag/twisted-22.2.0","tags":["x_transferred","Release Notes","Third Party Advisory","web","report"]},{"url":"https://twistedmatrix.com/trac/ticket/10284","tags":["x_transferred","Issue Tracking","Vendor Advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/03/msg00009.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","article","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_transferred","Patch","Third Party Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/","tags":["vendor-advisory","x_transferred","advisory"]},{"url":"https://security.gentoo.org/glsa/202301-02","tags":["vendor-advisory","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21716","tags":["advisory"]},{"url":"https://github.com/pypa/advisory-database/tree/main/vulns/twisted/PYSEC-2022-160.yaml","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6","tags":["web"]},{"url":"https://github.com/advisories/GHSA-rv6r-3f5q-9rgx"},{"url":"https://security.alpinelinux.org/vuln/CVE-2022-21716","tags":["advisory"]},{"url":"https://docs.bell-sw.com/security/cves/CVE-2022-21716","tags":["advisory"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/21xxx/CVE-2022-21716.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-21716","tags":["advisory"]},{"url":"https://github.com/twisted/twisted","tags":["package"]},{"url":"https://advisories.mageia.org/MGASA-2022-0168.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30067","tags":["report"]},{"url":"https://lists.suse.com/pipermail/sle-security-updates/2022-February/010263.html","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-2927","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/233XDDM6URC3DPBBAKQV2AZQY6TBXJRV/","tags":["web"]},{"url":"https://www.debian.org/lts/security/2022/dla-2938","tags":["web"]},{"url":"https://ubuntu.com/security/notices/USN-5354-1","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HJFVJUKPT7GYOWBWGQSIVM3OEHKOEVVJ/","tags":["web"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1908","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-21712","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24801","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-39348","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1909","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1970","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0982","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2051865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2060960","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0982.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21712","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21712","tags":["advisory"]},{"url":"https://github.com/twisted/twisted/security/advisories/GHSA-92x2-jw7w-xvvx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-21716","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-21716","tags":["advisory","report"]},{"url":"https://access.redhat.com/errata/RHSA-2022:0992","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2022/rhsa-2022_0992.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222070-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1196739","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2022-21716","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222117-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2022/suse-su-20222297-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-21716","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-5354-2","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2022-21712","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-24801","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2022-21716","title":"Buffer Overflow in Twisted","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u003c /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.","status":"published","published":"2022-03-03T00:00:00Z","modified":"2025-04-22T18:21:08.759Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T14:34:29.057251Z"}],"euvd":[{"id":"EUVD-2022-0344","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u003c /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.","status":"published","published":"2022-03-03T00:00:00Z","modified":"2025-04-22T18:21:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:15.026784Z"}],"ghsa":[{"id":"GHSA-rv6r-3f5q-9rgx","title":"Twisted SSH client and server deny of service during SSH handshake.","description":"### Impact\n\nThe Twisted SSH client and server implementation naively accepted an infinite amount of data for the  peer's SSH version identifier.\n\nA malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as `nc -rv localhost 22 \u003c /dev/zero`.\n\n### Patches\n\nThe issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1\n\nA fix is available in Twisted 22.2.0.\n\n### Workarounds\n\n* Limit access to the SSH server only to trusted source IP addresses.\n* Connect over SSH only to trusted destination IP addresses.\n\n### References\n\nReported at https://twistedmatrix.com/trac/ticket/10284\nDiscussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx\n\n### For more information\n\nFound by vin01","status":"published","published":"2022-03-03T19:02:08Z","modified":"2024-11-25T18:33:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-120","CWE-770"],"updated_at":"2026-11-02T14:38:23.575854Z"}],"nvd":[{"id":"CVE-2022-21716","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u003c /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.","status":"published","published":"2022-03-03T21:15:07.747Z","modified":"2026-06-17T04:26:50.78Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-120","CWE-770"],"updated_at":"2026-11-02T14:07:12.711288Z"}],"osv":[{"id":"ALPINE-CVE-2022-21716","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u003c /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.","status":"published","published":"2022-03-03T21:15:07.747Z","modified":"2026-11-03T07:30:18.113508335Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-03T07:50:38.973973Z"},{"id":"BELL-CVE-2022-21716","title":"CVE-2022-21716 does not affect BellSoft software","status":"withdrawn","published":"2023-08-31T12:13:56.892395Z","modified":"2026-01-26T09:48:29.277783Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:16.5265Z"},{"id":"CVE-2022-21716","title":"Buffer Overflow in Twisted","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u003c /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.","status":"published","published":"2022-03-03T00:00:00Z","modified":"2026-10-28T02:31:10.085368541Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-120"],"updated_at":"2026-11-02T15:44:23.655778Z"},{"id":"GHSA-rv6r-3f5q-9rgx","title":"Twisted SSH client and server deny of service during SSH handshake.","description":"### Impact\n\nThe Twisted SSH client and server implementation naively accepted an infinite amount of data for the  peer's SSH version identifier.\n\nA malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as `nc -rv localhost 22 \u003c /dev/zero`.\n\n### Patches\n\nThe issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1\n\nA fix is available in Twisted 22.2.0.\n\n### Workarounds\n\n* Limit access to the SSH server only to trusted source IP addresses.\n* Connect over SSH only to trusted destination IP addresses.\n\n### References\n\nReported at https://twistedmatrix.com/trac/ticket/10284\nDiscussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx\n\n### For more information\n\nFound by vin01","status":"published","published":"2022-03-03T19:02:08Z","modified":"2024-11-25T18:48:42.597453Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":8.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-120","CWE-770"],"updated_at":"2026-11-02T15:46:56.281047Z"},{"id":"OESA-2023-1908","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\ntwisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.(CVE-2022-21712)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer\u0026apos;s SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u0026lt; /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.(CVE-2022-21716)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web\u0026apos;s HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.(CVE-2022-24801)\r\n\r\nTwisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.(CVE-2022-39348)","status":"published","published":"2023-12-15T11:06:21Z","modified":"2026-08-18T01:18:05.460961379Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1909","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\ntwisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.(CVE-2022-21712)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer\u0026apos;s SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u0026lt; /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.(CVE-2022-21716)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web\u0026apos;s HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.(CVE-2022-24801)\r\n\r\nTwisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.(CVE-2022-39348)","status":"published","published":"2023-12-15T11:06:21Z","modified":"2026-08-18T01:18:05.391470179Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"OESA-2023-1970","title":"python-twisted security update","description":"Twisted is an event-based framework for internet applications, supporting Python 2.7 and Python 3.5+. It includes modules for many different purposes, including the following:\r\n\r\nSecurity Fix(es):\r\n\r\ntwisted is an event-driven networking engine written in Python. In affected versions twisted exposes cookies and authorization headers when following cross-origin redirects. This issue is present in the `twited.web.RedirectAgent` and `twisted.web. BrowserLikeRedirectAgent` functions. Users are advised to upgrade. There are no known workarounds.(CVE-2022-21712)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer\u0026apos;s SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u0026lt; /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.(CVE-2022-21716)\r\n\r\nTwisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to version 22.4.0rc1, the Twisted Web HTTP 1.1 server, located in the `twisted.web.http` module, parsed several HTTP request constructs more leniently than permitted by RFC 7230. This non-conformant parsing can lead to desync if requests pass through multiple HTTP parsers, potentially resulting in HTTP request smuggling. Users who may be affected use Twisted Web\u0026apos;s HTTP 1.1 server and/or proxy and also pass requests through a different HTTP server and/or proxy. The Twisted Web client is not affected. The HTTP 2.0 server uses a different parser, so it is not affected. The issue has been addressed in Twisted 22.4.0rc1. Two workarounds are available: Ensure any vulnerabilities in upstream proxies have been addressed, such as by upgrading them; or filter malformed requests by other means, such as configuration of an upstream proxy.(CVE-2022-24801)\r\n\r\nTwisted is an event-based framework for internet applications. Started with version 0.9.4, when the host header does not match a configured host `twisted.web.vhost.NameVirtualHost` will return a `NoResource` resource which renders the Host header unescaped into the 404 response allowing HTML and script injection. In practice this should be very difficult to exploit as being able to modify the Host header of a normal HTTP request implies that one is already in a privileged position. This issue was fixed in version 22.10.0rc1. There are no known workarounds.(CVE-2022-39348)","status":"published","published":"2023-12-22T11:06:25Z","modified":"2026-08-18T01:18:07.506247215Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:52:40.71472Z"},{"id":"RHSA-2022:0982","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.1 (python-twisted) security update","status":"published","published":"2024-09-18T05:55:21Z","modified":"2025-11-22T12:31:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"RHSA-2022:0992","title":"Red Hat Security Advisory: Red Hat OpenStack Platform 16.2 (python-twisted) security update","status":"published","published":"2024-09-18T05:55:12Z","modified":"2025-11-22T12:31:32Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"UBUNTU-CVE-2022-21716","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u003c /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.","status":"published","published":"2022-03-03T21:15:00Z","modified":"2026-02-04T02:16:52.330381Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:52.391598Z"},{"id":"DEBIAN-CVE-2022-21716","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u003c /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.","status":"published","published":"2022-03-03T21:15:07.747Z","modified":"2026-11-03T06:01:14.485269177Z","updated_at":"2026-11-03T06:44:26.638603Z"},{"id":"DLA-2938-1","title":"twisted - security update","status":"published","published":"2022-03-08T00:00:00Z","modified":"2026-03-09T01:18:12.269803Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"MGASA-2022-0168","title":"Updated python-twisted packages fix security vulnerability","description":"CVE-2022-21712: It was discovered that Twisted incorrectly filtered HTTP\nheaders when clients are being redirected to another origin. A remote\nattacker could use this issue to obtain sensitive information.\nCVE-2022-21716: It was discovered that Twisted incorrectly processed SSH\nhandshake data on connection establishments. A remote attacker could use\nthis issue to cause Twisted to crash, resulting in a denial of service.\n\nGHSA-rv6r-3f5q-9rgx\nThe Twisted SSH client and server implementation naively accepted an\ninfinite amount of data for the peer's SSH version identifier.\n\nGHSA-c2jg-hw38-jrqq and CVE-2022-24801\nThe Twisted Web HTTP 1.1 server, located in the twisted.web.http module,\nparsed several HTTP request constructs more leniently than permitted by\nRFC 7230\n\nGHSA-92x2-jw7w-xvvx: twisted.web.client.getPage,\ntwisted.web.client.downladPage, and the associated implementation classes\n(HTTPPageGetter, HTTPPageDownloader, HTTPClientFactory, HTTPDownloader)\nhave been removed because they do not segregate cookies by domain. They\nwere deprecated in Twisted 16.7.0 in favor of twisted.web.client.Agent.\n","status":"published","published":"2022-05-12T10:24:45Z","modified":"2026-04-16T04:40:45.962036274Z","updated_at":"2026-11-02T15:49:41.849028Z"},{"id":"openSUSE-SU-2024:11978-1","title":"python-Twisted-doc-22.2.0-1.1 on GA media","description":"These are all security issues fixed in the python-Twisted-doc-22.2.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:29:38.005688Z","updated_at":"2026-11-02T16:58:35.485255Z"},{"id":"PYSEC-2022-160","description":"Twisted is an event-based framework for internet applications, supporting Python 3.6+. Prior to 22.2.0, Twisted SSH client and server implement is able to accept an infinite amount of data for the peer's SSH version identifier. This ends up with a buffer using all the available memory. The attach is a simple as `nc -rv localhost 22 \u003c /dev/zero`. A patch is available in version 22.2.0. There are currently no known workarounds.","status":"published","published":"2022-03-03T21:15:00Z","modified":"2023-11-08T04:08:09.232676Z","updated_at":"2026-11-02T15:52:53.449407Z"},{"id":"SUSE-SU-2022:2070-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2022-21716: Fixed that ssh server accepts an infinite amount of data using all the available memory (bsc#1196739).\n","status":"published","published":"2022-06-14T09:56:13Z","modified":"2026-02-04T04:07:15.491843Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2117-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2022-21716: Fixed that ssh server accepts an infinite amount of data using all the available memory (bsc#1196739).\n","status":"published","published":"2022-06-20T10:08:30Z","modified":"2026-02-04T04:12:29.197925Z","updated_at":"2026-11-02T15:53:50.513981Z"},{"id":"SUSE-SU-2022:2297-1","title":"Security update for python-Twisted","description":"This update for python-Twisted fixes the following issues:\n\n- CVE-2022-21716: Fixed that ssh server accepts an infinite amount of data using all the available memory (bsc#1196739).\n","status":"published","published":"2022-07-06T11:35:30Z","modified":"2026-02-04T03:42:10.221607Z","updated_at":"2026-11-02T15:53:50.965375Z"},{"id":"USN-5354-1","title":"twisted vulnerabilities","description":"It was discovered that Twisted incorrectly filtered HTTP headers when clients \nare being redirected to another origin. A remote attacker could use this issue \nto obtain sensitive information. (CVE-2022-21712)\n\nIt was discovered that Twisted incorrectly processed SSH handshake data on \nconnection establishments. A remote attacker could use this issue to cause \nTwisted to crash, resulting in a denial of service. (CVE-2022-21716)\n","status":"published","published":"2022-03-30T08:17:48Z","modified":"2026-04-27T16:19:03.000417607Z","updated_at":"2026-11-02T16:58:15.683829Z"},{"id":"USN-5354-2","title":"twisted vulnerability","description":"USN-5354-1 fixed vulnerabilities in Twisted. This update provides the \ncorresponding updates for Ubuntu 14.04 ESM, Ubuntu 16.04 ESM and\nUbuntu 22.04 LTS.\n\nOriginal advisory details:\n \n It was discovered that Twisted incorrectly processed SSH handshake data on \n connection establishments. A remote attacker could use this issue to cause \n Twisted to crash, resulting in a denial of service. (CVE-2022-21716)\n","status":"published","published":"2022-05-05T08:14:06Z","modified":"2026-06-29T13:49:36.146793335Z","updated_at":"2026-11-02T16:58:15.683829Z"}]}}