Ecosyste.ms: Advisories
An open API service providing security vulnerability metadata for many open source software ecosystems.
Security Advisories: GSA_kwCzR0hTQS1ydjZyLTNmNXEtOXJneM0v7A
Twisted SSH client and server deny of service during SSH handshake.
Impact
The Twisted SSH client and server implementation naively accepted an infinite amount of data for the peer's SSH version identifier.
A malicious peer can trivially craft a request that uses all available memory and crash the server, resulting in denial of service. The attack is as simple as nc -rv localhost 22 < /dev/zero
.
Patches
The issue was fix in GitHub commit https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1
A fix is available in Twisted 22.2.0.
Workarounds
- Limit access to the SSH server only to trusted source IP addresses.
- Connect over SSH only to trusted destination IP addresses.
References
Reported at https://twistedmatrix.com/trac/ticket/10284
Discussions at https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx
For more information
Found by vin01
Permalink: https://github.com/advisories/GHSA-rv6r-3f5q-9rgxJSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1ydjZyLTNmNXEtOXJneM0v7A
Source: GitHub Advisory Database
Origin: Unspecified
Severity: High
Classification: General
Published: about 2 years ago
Updated: 7 months ago
CVSS Score: 7.5
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Identifiers: GHSA-rv6r-3f5q-9rgx, CVE-2022-21716
References:
- https://github.com/twisted/twisted/security/advisories/GHSA-rv6r-3f5q-9rgx
- https://github.com/twisted/twisted/commit/98387b39e9f0b21462f6abc7a1325dc370fcdeb1
- https://twistedmatrix.com/trac/ticket/10284
- https://nvd.nist.gov/vuln/detail/CVE-2022-21716
- https://github.com/twisted/twisted/releases/tag/twisted-22.2.0
- https://lists.debian.org/debian-lts-announce/2022/03/msg00009.html
- https://www.oracle.com/security-alerts/cpuapr2022.html
- https://lists.fedoraproject.org/archives/list/[email protected]/message/7U6KYDTOLPICAVSR34G2WRYLFBD2YW5K/
- https://lists.fedoraproject.org/archives/list/[email protected]/message/GLKHA6WREIVAMBQD7KKWYHPHGGNKMAG6/
- https://security.gentoo.org/glsa/202301-02
- https://github.com/advisories/GHSA-rv6r-3f5q-9rgx
Affected Packages
pypi:twisted
Dependent packages: 135Dependent repositories: 8,515
Downloads: 4,436,532 last month
Affected Version Ranges: >= 21.7.0, < 22.2.0
Fixed in: 22.2.0
All affected versions: 21.7.0, 22.1.0
All unaffected versions: 1.0.1, 1.0.3, 1.0.4, 1.0.5, 1.0.6, 1.0.7, 1.1.0, 1.1.1, 1.2.0, 2.1.0, 2.4.0, 2.5.0, 8.0.0, 8.0.1, 8.1.0, 8.2.0, 9.0.0, 10.0.0, 10.1.0, 10.2.0, 11.0.0, 11.1.0, 12.0.0, 12.1.0, 12.2.0, 12.3.0, 13.0.0, 13.1.0, 13.2.0, 14.0.0, 14.0.1, 14.0.2, 15.0.0, 15.1.0, 15.2.0, 15.2.1, 15.3.0, 15.4.0, 15.5.0, 16.0.0, 16.1.0, 16.1.1, 16.2.0, 16.3.0, 16.3.1, 16.3.2, 16.4.0, 16.4.1, 16.5.0, 16.6.0, 17.1.0, 17.5.0, 17.9.0, 18.4.0, 18.7.0, 18.9.0, 19.2.0, 19.2.1, 19.7.0, 19.10.0, 20.3.0, 21.2.0, 22.2.0, 22.4.0, 22.8.0, 22.10.0, 23.8.0, 23.10.0, 24.3.0