~ / search / GHSA-6cc5-2vg4-cc7m

GHSA-6cc5-2vg4-cc7m

Twisted CRLF Injection

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-12387

Packages

EcosystemPackageAffectedFixed in
PyPI twisted < 19.2.1 19.2.1

Details

As written in the advisory (Markdown source, shown as plain text).

In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.

References

External links from the advisory. They lead to third-party sites.